, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:25 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:25 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:25 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:25 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {0x0}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:25 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:25 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {0x0}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:26 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:26 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {0x0}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:26 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:26 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {0x0}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:26 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:26 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:27 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {0x0}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:27 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:27 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:27 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {0x0}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:27 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:27 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:27 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {0x0}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:28 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:28 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:28 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:28 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:28 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:28 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:28 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:28 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:28 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:29 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:29 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:29 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:29 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:29 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:29 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

[  931.225351][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  931.231680][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
23:29:29 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:29 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:29 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:30 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:30 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:30 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:30 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:30 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:30 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:30 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:31 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:31 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:31 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:31 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:31 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:31 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:32 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:32 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:32 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {0x0}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:32 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:32 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:32 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:32 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:32 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:32 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:32 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:32 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:32 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:33 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:33 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:33 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:33 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:33 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:33 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:33 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:34 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:34 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:34 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:34 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x2, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:34 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:34 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:34 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:34 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:35 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:35 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:35 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:35 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:35 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:35 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:35 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:35 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:35 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:35 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:36 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:36 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:36 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:36 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:36 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{0x0}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:36 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:36 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:37 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:37 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:37 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:37 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:37 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:37 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:37 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:37 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:37 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:38 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:38 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:38 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:38 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:38 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:38 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:38 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:38 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:38 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:39 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:39 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:39 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:39 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:39 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:39 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:39 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:39 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:40 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:40 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:40 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:40 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:40 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:40 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:40 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:40 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:41 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:41 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:41 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:41 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:41 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:41 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:41 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:42 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:42 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:42 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:42 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:42 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:42 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:42 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:42 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:42 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:42 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:43 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:43 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:43 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:43 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:43 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:43 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:43 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:43 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:43 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:44 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:44 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:44 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:44 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:44 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:44 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:44 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:29:44 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:44 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:44 executing program 0:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:29:45 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, 0x0, 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:45 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:45 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:45 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:45 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:45 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:45 executing program 0:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:29:45 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:46 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:46 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:46 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:46 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:29:46 executing program 5:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:29:50 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:55 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:57 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:57 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:29:57 executing program 5:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:29:57 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:57 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:57 executing program 0:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:29:57 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:57 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:58 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:58 executing program 4:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:29:59 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x0)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:00 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:00 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:05 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:05 executing program 5:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:05 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:07 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:07 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:07 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:07 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:07 executing program 4:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:07 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:07 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:07 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:07 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:07 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:07 executing program 1:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:07 executing program 4:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:07 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{0x0}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:07 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:07 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:12 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:12 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:12 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:13 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:13 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:17 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:17 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:17 executing program 1:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:18 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:18 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:18 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:18 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:18 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:18 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:18 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x0)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:18 executing program 1:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:18 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:18 executing program 2:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:18 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:18 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:19 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:19 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:19 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:19 executing program 2:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:19 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:19 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:19 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:20 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:20 executing program 2:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:20 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:20 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:20 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:20 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:21 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:21 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:21 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:21 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:21 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:21 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:21 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:22 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:22 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:22 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:22 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:22 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:22 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:22 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:22 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:22 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:23 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:23 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:23 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:23 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:23 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:23 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:23 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:24 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:24 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:24 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:24 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:24 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:24 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:25 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:25 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:25 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:25 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:25 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:25 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:26 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:26 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:26 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:26 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:26 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:26 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:26 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:27 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:27 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:27 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:27 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:27 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:27 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:27 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:27 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}], 0x1)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:27 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:28 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:28 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:28 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:28 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:28 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:28 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:28 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:28 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:29 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:29 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:29 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:29 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:29 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:29 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:29 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:30 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:30 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:30 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:30 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:30 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:30 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:30 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:31 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:31 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

[  992.652925][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  992.659908][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
23:30:31 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:31 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:31 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:31 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:31 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:32 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:32 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:32 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x0, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:32 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:32 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:32 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:30:32 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:33 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:33 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:33 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:33 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:30:33 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:33 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:34 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:34 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:34 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:34 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:30:34 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:34 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:35 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:35 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:35 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:35 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:35 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:30:35 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:35 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:36 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:36 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:36 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:36 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:36 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:36 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:36 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:36 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:37 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:37 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:37 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:37 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:37 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:37 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:38 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:38 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:38 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:38 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:38 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:38 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:38 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:39 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:39 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:39 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:39 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:39 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:39 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:40 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:40 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:40 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:40 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:40 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:40 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
r4 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000700)=0x401)

23:30:41 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:41 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:41 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:30:41 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:41 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:41 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:41 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:41 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:41 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:30:42 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:42 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:42 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:42 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:42 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:42 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:30:43 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:43 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:43 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:43 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:43 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:30:43 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:44 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:44 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:44 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:44 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:44 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:44 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:44 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:44 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:44 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:45 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:45 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:45 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:45 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:45 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:46 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:46 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:46 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:46 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:46 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:46 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:46 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:47 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:47 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:47 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:47 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:47 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:47 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:48 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:48 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:48 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:48 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:48 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:48 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:48 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:49 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:49 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:49 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:49 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:49 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:49 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:50 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:50 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:50 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:50 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:30:50 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:50 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:50 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, 0x0, 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:50 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:50 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:30:51 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:51 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:51 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:51 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:51 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:51 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:52 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:52 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:30:52 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:52 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:52 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:52 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:53 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:53 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:53 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:53 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:53 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:53 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:54 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:54 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:54 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:54 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:54 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:54 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:30:55 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:30:55 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:55 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:57 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:57 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:30:57 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, 0x0)

23:30:57 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:30:57 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:57 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:30:58 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:30:58 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:30:58 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:30:58 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:30:58 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:30:58 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, 0x0)

23:30:59 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:30:59 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, 0x0)

23:30:59 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:30:59 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:30:59 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, 0x0)

23:30:59 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:31:00 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:31:00 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, 0x0)

23:31:00 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(0x0, 0x7fffffff, 0x4080)

23:31:00 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:00 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:31:00 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:31:00 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, 0x0)

23:31:01 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:05 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:31:05 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700)=0x401)

23:31:05 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:05 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700))

23:31:05 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:05 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:31:05 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:05 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:06 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:06 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700))

23:31:06 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:31:07 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:07 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:08 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:08 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700))

23:31:08 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:31:08 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:31:09 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:09 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:09 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:09 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x0, 0x4080)

23:31:09 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700))

23:31:09 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:10 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:10 executing program 0:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:10 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, 0x0)

23:31:10 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:10 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:11 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700))

23:31:11 executing program 0:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:11 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:11 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:11 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:11 executing program 0:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:12 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700))

23:31:12 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:12 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:15 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, 0x0)

23:31:15 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:15 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:15 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:15 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:15 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:15 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:15 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:15 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:15 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, 0x0)

23:31:15 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:15 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:16 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700))

23:31:16 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:31:16 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:16 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:16 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:16 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:17 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700))

23:31:17 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:17 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:31:17 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:17 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:17 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:17 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700))

23:31:17 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:18 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:31:18 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:18 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:18 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:31:18 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700))

23:31:18 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:18 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500), 0x0)

23:31:18 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:18 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:18 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:19 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700))

23:31:19 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:19 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:19 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})

23:31:19 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:19 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:20 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
r5 = syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(r5, 0x2275, &(0x7f0000000700))

23:31:20 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:20 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:20 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})

23:31:20 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:20 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:20 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:20 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:21 executing program 3:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)

23:31:21 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:31:21 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:21 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:21 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:21 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:21 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:31:21 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)

23:31:22 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:22 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:22 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:22 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:22 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))

23:31:22 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)

23:31:22 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:22 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:23 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:23 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:23 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000), 0x8000)
unshare(0x44000080)

23:31:23 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:23 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:23 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:23 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:23 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:24 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
unshare(0x44000080)

23:31:24 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:24 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:24 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:24 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:24 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:24 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:24 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
unshare(0x44000080)

23:31:24 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:25 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:25 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:25 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:25 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:25 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500), 0x0)
unshare(0x44000080)

23:31:25 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:25 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:25 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:26 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:26 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:26 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
unshare(0x44000080)

23:31:26 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:26 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:26 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:26 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:26 executing program 3:
unshare(0x44000080)

23:31:26 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:27 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:27 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:27 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:27 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:27 executing program 1:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:27 executing program 3:
unshare(0x0)

23:31:27 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:27 executing program 3:
unshare(0x0)

23:31:27 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:28 executing program 3:
unshare(0x0)

23:31:28 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:28 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:28 executing program 0:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:28 executing program 1:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:28 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:28 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:28 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:28 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:29 executing program 0:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:29 executing program 1:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:29 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:29 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:29 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:29 executing program 4:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:29 executing program 0:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:29 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:29 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:30 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:30 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:30 executing program 0:
r0 = io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:30 executing program 4:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:30 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:30 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:30 executing program 2:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:31 executing program 0:
r0 = io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:31 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(0xffffffffffffffff, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:31 executing program 4:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:31 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:31 executing program 2:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:31 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:31 executing program 0:
r0 = io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:31 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:31 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:32 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:32 executing program 2:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:32 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:31:32 executing program 0:
r0 = io_uring_setup(0x7f16, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:32 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:32 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:32 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

[ 1054.092131][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[ 1054.098463][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
23:31:33 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:33 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:33 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:31:33 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:33 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:33 executing program 0:
r0 = io_uring_setup(0x7f16, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:33 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:34 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:34 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:34 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)

23:31:34 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:34 executing program 0:
r0 = io_uring_setup(0x7f16, 0x0)
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:34 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:34 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:34 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:34 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:34 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:35 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500), 0x0)

23:31:35 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:35 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0))
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:35 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:35 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:35 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:35 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})

23:31:36 executing program 5:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:36 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:36 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:36 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:36 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:36 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})

23:31:37 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:37 executing program 5:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:37 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:37 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:37 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:37 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})

23:31:37 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:37 executing program 5:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:38 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:38 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:38 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:38 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r1})

23:31:38 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:38 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:38 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:38 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:39 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:39 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, r1})

23:31:39 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:39 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:39 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:39 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:39 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:39 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)

23:31:39 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:40 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:40 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))

23:31:40 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:40 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:40 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:40 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)

23:31:40 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:41 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, 0x0)

23:31:41 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:41 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:41 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:41 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000), 0x8000)
unshare(0x44000080)

23:31:41 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:41 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:41 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:41 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:42 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000), 0x8000)
unshare(0x44000080)

23:31:42 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:42 executing program 1:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:42 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:42 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:42 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:42 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000), 0x8000)
unshare(0x44000080)

23:31:43 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:43 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:56 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:56 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:56 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:56 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, 0x0, 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:56 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)

23:31:56 executing program 1:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:56 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:31:57 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:31:57 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:31:57 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, 0x0, 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:31:57 executing program 1:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:31:57 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)

23:31:57 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:32:03 executing program 2:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:32:03 executing program 2:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:32:03 executing program 2:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:32:04 executing program 2:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:32:08 executing program 2:
r0 = io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

23:32:09 executing program 2:
r0 = io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

[ 1090.803397][  T158] ==================================================================
[ 1090.811713][  T158] BUG: KASAN: user-memory-access in dst_release+0x1f/0xe0
[ 1090.818910][  T158] Write of size 4 at addr 000000010000003f by task kworker/u4:3/158
[ 1090.826889][  T158] 
[ 1090.829218][  T158] CPU: 0 PID: 158 Comm: kworker/u4:3 Not tainted 5.15.0-rc6-syzkaller #0
[ 1090.837633][  T158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1090.847693][  T158] Workqueue: netns cleanup_net
[ 1090.852552][  T158] Call Trace:
[ 1090.855837][  T158]  dump_stack_lvl+0x1dc/0x2d8
[ 1090.860530][  T158]  ? show_regs_print_info+0x12/0x12
[ 1090.865736][  T158]  ? log_buf_vmcoreinfo_setup+0x498/0x498
[ 1090.871465][  T158]  ? _raw_spin_lock_irqsave+0xdd/0x120
[ 1090.876947][  T158]  ? free_percpu+0x86e/0xde0
[ 1090.881584][  T158]  ? dst_release+0x1f/0xe0
[ 1090.886008][  T158]  kasan_report+0x190/0x1f0
[ 1090.890520][  T158]  ? dst_release+0x1f/0xe0
[ 1090.894952][  T158]  kasan_check_range+0x2b5/0x2f0
[ 1090.899900][  T158]  dst_release+0x1f/0xe0
[ 1090.904153][  T158]  dst_cache_destroy+0x107/0x1e0
[ 1090.909180][  T158]  ip_tunnel_dev_free+0x21/0x50
[ 1090.914096][  T158]  ? ip_tunnel_init+0x3c0/0x3c0
[ 1090.918957][  T158]  netdev_run_todo+0xaa0/0xcf0
[ 1090.923740][  T158]  ? alloc_netdev_mqs+0xc20/0xc20
[ 1090.928786][  T158]  ? netdev_refcnt_read+0x50/0x50
[ 1090.933824][  T158]  ? unregister_netdevice_queue+0x258/0x350
[ 1090.939734][  T158]  ? list_netdevice+0x450/0x450
[ 1090.944615][  T158]  ip_tunnel_delete_nets+0x32a/0x370
[ 1090.949944][  T158]  ? ip_tunnel_bind_dev+0x8d0/0x8d0
[ 1090.955150][  T158]  ? kfree+0xe1/0x310
[ 1090.959151][  T158]  ? ipgre_tap_init_net+0x30/0x30
[ 1090.964280][  T158]  cleanup_net+0x7ec/0xc50
[ 1090.968914][  T158]  ? ops_free_list+0x350/0x350
[ 1090.973699][  T158]  ? _raw_spin_unlock_irq+0x1f/0x40
[ 1090.979008][  T158]  process_one_work+0x853/0x1140
[ 1090.984051][  T158]  ? worker_detach_from_pool+0x260/0x260
[ 1090.989956][  T158]  ? _raw_spin_lock_irqsave+0x120/0x120
[ 1090.995518][  T158]  ? kthread_data+0x4d/0xc0
23:32:09 executing program 4:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
openat$cgroup(0xffffffffffffffff, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)
ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000700)=0x401)

23:32:09 executing program 1:
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r1, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>r1})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r1, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))

23:32:09 executing program 5:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r2=>0xffffffffffffffff})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r2})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
openat$cgroup(r3, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r3, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x4080)

23:32:09 executing program 3:
io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
openat$cgroup(r0, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
unshare(0x44000080)

23:32:09 executing program 0:
r0 = io_uring_setup(0x7f16, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, 0x0, 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, 0x0)

23:32:09 executing program 2:
r0 = io_uring_setup(0x0, &(0x7f0000000380)={0x0, 0x3441, 0x0, 0x0, 0x1})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
openat$cgroup(r1, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)={0x8000, 0x5, 0x4, 0x2, 0x100, {0x0, 0xea60}, {0x5, 0x2, 0x3, 0x6, 0xff, 0x41, "464b0903"}, 0x3, 0x2, @userptr=0x6})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x8000)
recvmsg$can_raw(r2, &(0x7f0000000440)={&(0x7f00000001c0)=@caif, 0x80, &(0x7f0000000400)=[{&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000340)=""/20, 0x14}], 0x3, &(0x7f00000005c0)=""/241, 0xf1}, 0x40002003)
io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1)
unshare(0x44000080)
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000800)=[{0x0}, {0x0}], 0x2)
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000480)={0x0, 0x1, <r3=>r2})
ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r2, 0xc01064c2, &(0x7f00000004c0)={0x0, 0x0, r3})
pipe2(&(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
openat$cgroup(r4, &(0x7f0000000580)='syz0\x00', 0x200002, 0x0)
ioctl$SG_GET_COMMAND_Q(r4, 0x2270, &(0x7f0000000540))
syz_open_dev$sg(&(0x7f00000006c0), 0x7fffffff, 0x0)

[ 1091.000101][  T158]  ? wq_worker_running+0x8b/0x140
[ 1091.005141][  T158]  worker_thread+0xac1/0x1320
[ 1091.009864][  T158]  kthread+0x453/0x480
[ 1091.013938][  T158]  ? rcu_lock_release+0x20/0x20
[ 1091.018800][  T158]  ? kthread_blkcg+0xd0/0xd0
[ 1091.023399][  T158]  ret_from_fork+0x1f/0x30
[ 1091.027910][  T158] ==================================================================
[ 1091.035966][  T158] Disabling lock debugging due to kernel taint
[ 1091.135037][  T158] Kernel panic - not syncing: panic_on_warn set ...
[ 1091.141655][  T158] CPU: 1 PID: 158 Comm: kworker/u4:3 Tainted: G    B             5.15.0-rc6-syzkaller #0
[ 1091.151456][  T158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1091.161518][  T158] Workqueue: netns cleanup_net
[ 1091.166295][  T158] Call Trace:
[ 1091.169573][  T158]  dump_stack_lvl+0x1dc/0x2d8
[ 1091.174257][  T158]  ? show_regs_print_info+0x12/0x12
[ 1091.179724][  T158]  ? log_buf_vmcoreinfo_setup+0x498/0x498
[ 1091.185454][  T158]  ? preempt_schedule+0x16b/0x190
[ 1091.190485][  T158]  ? schedule_preempt_disabled+0x20/0x20
[ 1091.196127][  T158]  panic+0x2d6/0x810
[ 1091.200095][  T158]  ? trace_hardirqs_on+0x30/0x80
[ 1091.205110][  T158]  ? nmi_panic+0x90/0x90
[ 1091.209359][  T158]  ? _raw_spin_unlock_irqrestore+0x128/0x130
[ 1091.215349][  T158]  ? free_percpu+0x86e/0xde0
[ 1091.219973][  T158]  ? dst_release+0x1f/0xe0
[ 1091.224391][  T158]  end_report+0x83/0x90
[ 1091.228542][  T158]  kasan_report+0x1bf/0x1f0
[ 1091.233050][  T158]  ? dst_release+0x1f/0xe0
[ 1091.237471][  T158]  kasan_check_range+0x2b5/0x2f0
[ 1091.242415][  T158]  dst_release+0x1f/0xe0
[ 1091.246668][  T158]  dst_cache_destroy+0x107/0x1e0
[ 1091.251698][  T158]  ip_tunnel_dev_free+0x21/0x50
[ 1091.256554][  T158]  ? ip_tunnel_init+0x3c0/0x3c0
[ 1091.261500][  T158]  netdev_run_todo+0xaa0/0xcf0
[ 1091.266280][  T158]  ? alloc_netdev_mqs+0xc20/0xc20
[ 1091.271316][  T158]  ? netdev_refcnt_read+0x50/0x50
[ 1091.276347][  T158]  ? unregister_netdevice_queue+0x258/0x350
[ 1091.282249][  T158]  ? list_netdevice+0x450/0x450
[ 1091.287116][  T158]  ip_tunnel_delete_nets+0x32a/0x370
[ 1091.292423][  T158]  ? ip_tunnel_bind_dev+0x8d0/0x8d0
[ 1091.297627][  T158]  ? kfree+0xe1/0x310
[ 1091.301615][  T158]  ? ipgre_tap_init_net+0x30/0x30
[ 1091.306642][  T158]  cleanup_net+0x7ec/0xc50
[ 1091.311068][  T158]  ? ops_free_list+0x350/0x350
[ 1091.315839][  T158]  ? _raw_spin_unlock_irq+0x1f/0x40
[ 1091.321046][  T158]  process_one_work+0x853/0x1140
[ 1091.325996][  T158]  ? worker_detach_from_pool+0x260/0x260
[ 1091.331633][  T158]  ? _raw_spin_lock_irqsave+0x120/0x120
[ 1091.337186][  T158]  ? kthread_data+0x4d/0xc0
[ 1091.341693][  T158]  ? wq_worker_running+0x8b/0x140
[ 1091.346753][  T158]  worker_thread+0xac1/0x1320
[ 1091.351442][  T158]  kthread+0x453/0x480
[ 1091.355510][  T158]  ? rcu_lock_release+0x20/0x20
[ 1091.360363][  T158]  ? kthread_blkcg+0xd0/0xd0
[ 1091.364958][  T158]  ret_from_fork+0x1f/0x30
[ 1091.369628][  T158] Kernel Offset: disabled
[ 1091.373939][  T158] Rebooting in 86400 seconds..