41ca359eee4a3166de77fdc7b64d57e8533e944bd9f1407ef091a2947aad8bee163aa667217adb3ae179d79ce50ffe89977b974210058f99eea2f9b319babfbdc74ddfbcae5ddb263df781310996d54a9d0f788f02f64dedced3da510100196574e9e2fc774f79842c5d387b4df1176cd4f6d4d278aedd6e1e7572d6d7c2bb8cd567bed7ded84f31525533982fe8052b429a7dfad39b177088208519cba0ea58d059372d1a7780ea697294d8b1e4d0bd4eea79183198d5a8611e34991619fc090fea72b582f3db60183a9a636e084e13d4d41ebd3c5e4917836a76cc927643e42b56078cb81eb9957f0d8cd98d64d401431d978b33e7ebd5e8058a41a9399e3c8f7f664dee998a75fa86ebd1285afb57d0a647db24ddd2ae64b6180ce9c749cf79dda5f64541f2c22cb015ec8d34c67ec9f75eff79e2d8bf8c2d442b647af4516a008be721ede01a5c1126b09081b0184a0bb644cec2d304b967b988a315bb3fa49407918e0bf62abac65c284f447d8054f6d6d047dc05eda5006646bf6d485d62caacca20522bdbda8e2524a90ea2e3b37410e859759a5c2ffb17a2ad96a8af405c24a63a27073f88dc3f53fbeac1ac5aa2fe6e8866ac755948f135943d3ab54ec9af5e120128ca319fa76877d7241c54391d309ad161e3d956811d3390cdafa1b1ae1c25554153defa161a82871e019d12abc83e6b89ce732e0dd3e39b2c2496e83a7f135bc496c18f8a5d444bf95b897241bcc13666e0c1cce55d65e508af2b6e59facdff0865f81c5df7673e221e2fcd547d93ca82344d81a7c4a48176ea90a8a9d5b2f14e9336b93df8920d9422771c7ec5300c64ebc7d76095501d01f2e380aaa48e0028b17bb62f6fd6fbfd0f7e38e0e182ce8ae7bb5d5bd6d6db3293bafb5df84b2216e6677d9c4b55bef6dfd9f90cbcd0afeb1a7ed4423edf68cc69309230be46349bd753b02c213882e046beb8ec269d8715d613632e4054144f36963d9e75bd01ebd9d391c33e27aca90fab229c280cef70463fa4757f2a3263f9831211fb09e902b3390defb10539bb10491fac81b83dc5ca746313e2bb6ce0ee5bd43fc640be56f3400707beb7b4587b0f10006b17e80326b5f629a07740550845fb28c3b09c967e1b5c305466b3f8dd844a2c955917178ccf6ee8ef6eaa234d75365a0d9b4d600142d95b34287882ba082734ddbc9dc73699c0fbe631304923a2dd696c5fbb815f72b3a988f04c74d2982b5cce8260ae8d6893c319361fcb77ed242f26227591b797d14ae80b9c5afc8a18fad7da23e1a314aca901c54a1061e064e12eaab1ca472ca484d2c090811675e7d7ff811a38543f0d39d036f4c284dbc6497a3193b1d09d6f8c7e84d194a42d6c0ee551c2ef90d939d783ac6f0a0cd957edbd7b38cb4ad465c91f8ecc16176e94fb6a70a34531af50af9c47ade8fb6c6dc5e6a9bf7d4ea6b3b70fcc7d193b915942c82dec34af3c323d9bfbf269a645bf6e136d3fb335c55d5ea0779b5da942632cc294118070d59d7963e534629a8e326651eb9b6af586e5896b778cacc05f20ff9879251bd3304fac3ed0549d19a242a74738813488c5231e3f312b8cd295e39a2ba3c59c432b58100e6ef9fba040f12529ce8ac6a7aac58b2b57593efa4442a1c2f1a4a9de383e95ee6a8187eaa534eeacc928b7185d51a43c0f596d877d5f2a123a0e9c911f8d39d5efc18265971f8c65ffa9cbb40b6e7c10cc330440bdbba7cc49bc7a6d2df8456259b7654f9f8b64590768a9560d76842d42a24fe306e614bd6c6653491e17a4a9885a3647a99e53429f0c7a99e2dc72e81f27f4a7b35893626dbf9690b2d4f30b241bb3af782fce00c918c5074100706448a50115c9e1e87b02dd86f3da3adc88d3db94e1bc545e36ab97c5b97dc54e7e9da144abba3bb41e8fb165de5899c844d8577b07949fe73f56cf195cdb370d63f328d0ad29a3aebe303ca7ea7eefc495808634d2cebda74ac73a44b7a05bac77c266d680ea6c877f40e516951692b4f9d57ba7b3319f503d0f51a6ecb79373bd67ec3b8f12d912ab4a905f50d85938d66c587d1065e6cc89cdbc6d0f44c8152a2163931b90f3ee0ec6ae373447ce88b32f97abf165ece2c941da73113e77e151ffb4b3ef679a633f7de90cbd02b7784a7852033047e714be6e37ad7feea3e965390a70ac2e809ed45cd860baa61caca8dce1accf6dfdd3c5f51f8f33ff3e5378dcb9c0e01c861520c3b9a89f4019841cd452b1da6db79e63b4ce285b59a35a6a55e9f20275b8bfcfd9f1c9740a2d61952c859cb1197f215ede0c000c920fa994c2f2920c61d768142c8a7f558e19d309565dcf156c98b61bfee3726c47dc8f3b30dd307635fb803c5c47aa195519bf91ab240164b250be721aabda9c7b9ffe2c86823c06d43037c9622b25d63c63d243120406ded2b9204b2c7e192574f7986a02f92b12f3ff116f4e69ff996755d783231c04d40cb61dbc998c56e1f9d3fadf0c6e91f03406afd36eebb8ab4fd3664bd2869e582455472c6734016a0fa7f387"}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r7, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r8, 0x8000, 0x8}, 0xc) 00:11:10 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000040), 0x4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="20042abd7000fbdbdf2505000000080019007f0000010500060040000000050012005500000008000a00020000000c00100001000000000000000c0010000000000000010000"], 0x4c}, 0x1, 0x0, 0x0, 0x44804}, 0x4000) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r7, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) 00:11:11 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x88940, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, r3, 0x10, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x4c, 0x18, {0x1ff, @media='udp\x00'}}}, ["", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x40000c5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:11 executing program 5: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x20ffb000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x2000)=nil, 0x3, 0x5, 0x8}) 00:11:11 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1) 00:11:11 executing program 1: setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000100), 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x24e6, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, &(0x7f00000000c0)) 00:11:11 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000780)={0x0, 0x0, 0x0, &(0x7f0000000000), 0xe, 0x0, &(0x7f0000002280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000000)=[{0x0, 0x80000000}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x2, 0x0, &(0x7f0000000700)=[{}, {}]}) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r5, 0xc0347c03, &(0x7f0000000100)={{r3, r2, 0xc, [0x9, 0x400]}, {r1, r4, 0x1, [0x3, 0x8000]}, 0x10000000, [0x5, 0x6]}) setsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000140)=0x1, 0x4) r6 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r6, 0xc0105512, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r7, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r8, 0x8000, 0x8}, 0xc) 00:11:11 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000040), 0x4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="20042abd7000fbdbdf2505000000080019007f0000010500060040000000050012005500000008000a00020000000c00100001000000000000000c0010000000000000010000"], 0x4c}, 0x1, 0x0, 0x0, 0x44804}, 0x4000) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) 00:11:11 executing program 5: syz_io_uring_setup(0x535b, &(0x7f0000000100)={0x0, 0xd9e6, 0x0, 0x0, 0x2c0}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r0, r2, &(0x7f0000000200)=@IORING_OP_NOP={0x0, 0x9}, 0x0) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000280)={&(0x7f0000ffb000/0x4000)=nil, 0x1, 0x3, 0x2}) setsockopt$CAN_RAW_JOIN_FILTERS(0xffffffffffffffff, 0x65, 0x6, &(0x7f00000000c0)=0x1, 0x4) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, &(0x7f0000000000), &(0x7f0000000040)=0x4) socketpair(0x28, 0xa, 0x7, &(0x7f00000002c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:11 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1) 00:11:11 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000780)={0x0, 0x0, 0x0, &(0x7f0000000000), 0xe, 0x0, &(0x7f0000002280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000000)=[{0x0, 0x80000000}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x2, 0x0, &(0x7f0000000700)=[{}, {}]}) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r5, 0xc0347c03, &(0x7f0000000100)={{r3, r2, 0xc, [0x9, 0x400]}, {r1, r4, 0x1, [0x3, 0x8000]}, 0x10000000, [0x5, 0x6]}) setsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000140)=0x1, 0x4) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r6, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r7, 0x8000, 0x8}, 0xc) 00:11:11 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:11 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0) 00:11:11 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000040), 0x4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="20042abd7000fbdbdf2505000000080019007f0000010500060040000000050012005500000008000a00020000000c00100001000000000000000c0010000000000000010000"], 0x4c}, 0x1, 0x0, 0x0, 0x44804}, 0x4000) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) 00:11:11 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:11 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x88940, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, r3, 0x10, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x4c, 0x18, {0x1ff, @media='udp\x00'}}}, ["", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x40000c5) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:11 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000780)={0x0, 0x0, 0x0, &(0x7f0000000000), 0xe, 0x0, &(0x7f0000002280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000000)=[{0x0, 0x80000000}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x2, 0x0, &(0x7f0000000700)=[{}, {}]}) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r5, 0xc0347c03, &(0x7f0000000100)={{r3, r2, 0xc, [0x9, 0x400]}, {r1, r4, 0x1, [0x3, 0x8000]}, 0x10000000, [0x5, 0x6]}) setsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000140)=0x1, 0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r6, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r7, 0x8000, 0x8}, 0xc) 00:11:11 executing program 5: socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0x22, 0x6, 0x3ff) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000000)=[{{0x1, 0x1, 0x1}, {0x0, 0x1}}], 0x8) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:11 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair(0x2c, 0x80000, 0x514c1704, &(0x7f0000000100)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000280)={&(0x7f0000000140), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09082cbd7000fbdbdf25fa0100000800de954c", @ANYRES32, @ANYBLOB="050007000300000006000100050000000500140081000000060002000000000008000b000300000006001a004e20000008001900ac1e01010600020000000000"], 0x64}, 0x1, 0x0, 0x0, 0x11}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x13, 0x2}}) 00:11:11 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000780)={0x0, 0x0, 0x0, &(0x7f0000000000), 0xe, 0x0, &(0x7f0000002280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000000)=[{0x0, 0x80000000}, {0x0, 0x80000000, 0x0, {0x0}}, {}, {}, {}, {0x0, 0x80000000, 0x0, {0x0}}], 0x2, 0x0, &(0x7f0000000700)=[{}, {}]}) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) ioctl$MEDIA_IOC_SETUP_LINK(r5, 0xc0347c03, &(0x7f0000000100)={{r3, r2, 0xc, [0x9, 0x400]}, {r1, r4, 0x1, [0x3, 0x8000]}, 0x10000000, [0x5, 0x6]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r6, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r7, 0x8000, 0x8}, 0xc) 00:11:11 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x20ffb000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0xd7e, &(0x7f0000000000)={0x0, 0x17a1, 0xe, 0x1, 0x11c}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f00000000c0)) r0 = userfaultfd(0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000140)={&(0x7f0000ff0000/0x10000)=nil, 0x10000}) ioctl$USBDEVFS_RESET(0xffffffffffffffff, 0x5514) syz_open_dev$usbfs(&(0x7f0000000080), 0x0, 0x50000) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x0, 0x8801) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f00000001c0)=0x3) 00:11:11 executing program 5: socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0x22, 0x6, 0x3ff) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000000)=[{{0x1, 0x1, 0x1}, {0x0, 0x1}}], 0x8) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:11 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:11 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000040), 0x4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="20042abd7000fbdbdf2505000000080019007f0000010500060040000000050012005500000008000a00020000000c00100001000000000000000c0010000000000000010000"], 0x4c}, 0x1, 0x0, 0x0, 0x44804}, 0x4000) socket$nl_generic(0x10, 0x3, 0x10) 00:11:11 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x88940, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, r3, 0x10, 0x70bd28, 0x25dfdbfc, {{}, {}, {0x4c, 0x18, {0x1ff, @media='udp\x00'}}}, ["", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x40000c5) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async, rerun: 32) r4 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 32) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:11 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000780)={0x0, 0x0, 0x0, &(0x7f0000000000), 0xe, 0x0, &(0x7f0000002280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000700)=[{}, {}]}) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r2, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r3, 0x8000, 0x8}, 0xc) 00:11:11 executing program 5: socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0x22, 0x6, 0x3ff) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000000)=[{{0x1, 0x1, 0x1}, {0x0, 0x1}}], 0x8) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000580)={&(0x7f00000003c0), 0xfffffe81, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, ["", "", ""]}, 0x1c}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r2) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, r3, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, r3, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004840}, 0x0) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:11 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:11 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000780)={0x0, 0x0, 0x0, &(0x7f0000000000), 0xe, 0x0, &(0x7f0000002280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000700)=[{}, {}]}) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r1, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r2, 0x8000, 0x8}, 0xc) 00:11:11 executing program 5: socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0x22, 0x6, 0x3ff) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000000)=[{{0x1, 0x1, 0x1}, {0x0, 0x1}}], 0x8) 00:11:11 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000040), 0x4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="20042abd7000fbdbdf2505000000080019007f0000010500060040000000050012005500000008000a00020000000c00100001000000000000000c0010000000000000010000"], 0x4c}, 0x1, 0x0, 0x0, 0x44804}, 0x4000) 00:11:11 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x48f0, &(0x7f0000000000)={0x0, 0x8a98, 0x10, 0x2, 0x221}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)=0x0) syz_io_uring_submit(r0, r2, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x4, 0x6000, @fd_index=0x8, 0x5b, 0x1, 0x400, 0x16, 0x0, {0x3}}, 0x3) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:11 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000780)={0x0, 0x0, 0x0, &(0x7f0000000000), 0xe, 0x0, &(0x7f0000002280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000700)=[{}, {}]}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r1, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r2, 0x8000, 0x8}, 0xc) 00:11:11 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:11 executing program 5: socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) socket(0x22, 0x6, 0x3ff) 00:11:12 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r1, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r2, 0x8000, 0x8}, 0xc) 00:11:12 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x48f0, &(0x7f0000000000)={0x0, 0x8a98, 0x10, 0x2, 0x221}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)=0x0) syz_io_uring_submit(r0, r2, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x4, 0x6000, @fd_index=0x8, 0x5b, 0x1, 0x400, 0x16, 0x0, {0x3}}, 0x3) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:12 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x17, 0x12}}) 00:11:12 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:12 executing program 5: socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) 00:11:12 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x10, &(0x7f0000000040), 0x4) 00:11:12 executing program 2: openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:12 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:12 executing program 5: socket$can_raw(0x1d, 0x3, 0x1) 00:11:12 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x48f0, &(0x7f0000000000)={0x0, 0x8a98, 0x10, 0x2, 0x221}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)=0x0) syz_io_uring_submit(r0, r2, &(0x7f0000000100)=@IORING_OP_WRITE_FIXED={0x5, 0x4, 0x6000, @fd_index=0x8, 0x5b, 0x1, 0x400, 0x16, 0x0, {0x3}}, 0x3) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:12 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:12 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) socket$inet_tcp(0x2, 0x1, 0x0) 00:11:12 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:12 executing program 5: openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:12 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x17, 0x12}}) 00:11:12 executing program 2: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:12 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x48f0, &(0x7f0000000000)={0x0, 0x8a98, 0x10, 0x2, 0x221}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) sendmsg$TIPC_CMD_SHOW_PORTS(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r2, 0x2, 0x70bd25, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x844}, 0x4000000) sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r1, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x8, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x1}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x8810) syz_io_uring_setup(0x21e5, &(0x7f0000000000)={0x0, 0xfffffffd}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0xfffffffffffffffe, 0x0) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2) 00:11:12 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:12 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) 00:11:12 executing program 2: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:12 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:12 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) socket$inet_tcp(0x2, 0x1, 0x0) 00:11:12 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:12 executing program 2: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:12 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:12 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x17, 0x12}}) 00:11:12 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:12 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) 00:11:12 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:12 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) socket$inet_tcp(0x2, 0x1, 0x0) 00:11:12 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:12 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:12 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:12 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:12 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0xf34b, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:12 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:12 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) socket$igmp(0x2, 0x3, 0x2) 00:11:13 executing program 3: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'gre0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0001002800000006000000014d4800340068000500000000000000bb640101010717c0ac1414bbac14140aac1414bb64010101ac1414bb019404000001000000"]}) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000140)="421754f5a0298d39887b3f759aa88561506fe90dffdee4f5e7d9086b7896290cc29b1a4ec33eb9c5d7517b6d82d5061d341643c31ec146058430e5912c101a36f7808653617172c66ccc2d801d3990ffee40e0b4dd4b66e0ce786391ed89e73e4c0abd72a8455b27ace44f8de3e9d22258c4dd9e1617f1ceb0fd7c01013e7c0e0f1bbd0c2f877a1acf1a62336ce030e5", 0x90) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:13 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:13 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) socket$inet_tcp(0x2, 0x1, 0x0) 00:11:13 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:13 executing program 0: syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:13 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) 00:11:13 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x0, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:13 executing program 0: syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:13 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:13 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x0, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:13 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:13 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r0) 00:11:13 executing program 3: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'gre0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0001002800000006000000014d4800340068000500000000000000bb640101010717c0ac1414bbac14140aac1414bb64010101ac1414bb019404000001000000"]}) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000140)="421754f5a0298d39887b3f759aa88561506fe90dffdee4f5e7d9086b7896290cc29b1a4ec33eb9c5d7517b6d82d5061d341643c31ec146058430e5912c101a36f7808653617172c66ccc2d801d3990ffee40e0b4dd4b66e0ce786391ed89e73e4c0abd72a8455b27ace44f8de3e9d22258c4dd9e1617f1ceb0fd7c01013e7c0e0f1bbd0c2f877a1acf1a62336ce030e5", 0x90) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'gre0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0001002800000006000000014d4800340068000500000000000000bb640101010717c0ac1414bbac14140aac1414bb64010101ac1414bb019404000001000000"]}) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000140)="421754f5a0298d39887b3f759aa88561506fe90dffdee4f5e7d9086b7896290cc29b1a4ec33eb9c5d7517b6d82d5061d341643c31ec146058430e5912c101a36f7808653617172c66ccc2d801d3990ffee40e0b4dd4b66e0ce786391ed89e73e4c0abd72a8455b27ace44f8de3e9d22258c4dd9e1617f1ceb0fd7c01013e7c0e0f1bbd0c2f877a1acf1a62336ce030e5", 0x90) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) 00:11:13 executing program 0: syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:13 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x0, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:13 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:13 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) 00:11:13 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) 00:11:13 executing program 0: syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:13 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x0, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:13 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:13 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x0, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:13 executing program 0: syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:13 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) 00:11:13 executing program 3: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'gre0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0001002800000006000000014d4800340068000500000000000000bb640101010717c0ac1414bbac14140aac1414bb64010101ac1414bb019404000001000000"]}) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000140)="421754f5a0298d39887b3f759aa88561506fe90dffdee4f5e7d9086b7896290cc29b1a4ec33eb9c5d7517b6d82d5061d341643c31ec146058430e5912c101a36f7808653617172c66ccc2d801d3990ffee40e0b4dd4b66e0ce786391ed89e73e4c0abd72a8455b27ace44f8de3e9d22258c4dd9e1617f1ceb0fd7c01013e7c0e0f1bbd0c2f877a1acf1a62336ce030e5", 0x90) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'gre0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0001002800000006000000014d4800340068000500000000000000bb640101010717c0ac1414bbac14140aac1414bb64010101ac1414bb019404000001000000"]}) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000140)="421754f5a0298d39887b3f759aa88561506fe90dffdee4f5e7d9086b7896290cc29b1a4ec33eb9c5d7517b6d82d5061d341643c31ec146058430e5912c101a36f7808653617172c66ccc2d801d3990ffee40e0b4dd4b66e0ce786391ed89e73e4c0abd72a8455b27ace44f8de3e9d22258c4dd9e1617f1ceb0fd7c01013e7c0e0f1bbd0c2f877a1acf1a62336ce030e5", 0x90) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) 00:11:13 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) socket$igmp(0x2, 0x3, 0x2) 00:11:13 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x0, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:13 executing program 0: syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:13 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x30c}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:13 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r3, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x9, @link='syz1\x00'}}}, ["", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x84}, 0x8000) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:13 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:13 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:13 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:14 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:14 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:14 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:14 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) socket$l2tp6(0xa, 0x2, 0x73) 00:11:14 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000100)) 00:11:14 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x8000, 0x8}, 0xc) 00:11:14 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:14 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000100)) 00:11:14 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r3, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x9, @link='syz1\x00'}}}, ["", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x84}, 0x8000) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:14 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) socket(0x0, 0x800, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:14 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:14 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:14 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000100)) 00:11:14 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) 00:11:14 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:14 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:14 executing program 0: syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:14 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:14 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) 00:11:14 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:14 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r3, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x9, @link='syz1\x00'}}}, ["", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x84}, 0x8000) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:14 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:14 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) mmap$dsp(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x2000002, 0x11, 0xffffffffffffffff, 0x0) 00:11:14 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:14 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r0, 0x8000, 0x8}, 0xc) 00:11:14 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:14 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:14 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r0, 0x8000, 0x8}, 0xc) 00:11:14 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = socket(0x0, 0x800, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:14 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:14 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:14 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r0, 0x8000, 0x8}, 0xc) 00:11:15 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@mcast1, @loopback, 0x0, 0x200b}}) 00:11:15 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x0, 0x0}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:15 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 4: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) socket(0x0, 0x800, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x0, 0x0}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:15 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 4: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x0, 0x0}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:15 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@mcast1, @loopback, 0x0, 0x200b}}) 00:11:15 executing program 4: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 0: syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) 00:11:15 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000100)) 00:11:15 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) 00:11:15 executing program 0: syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 1: syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:15 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@mcast1, @loopback, 0x0, 0x200b}}) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) 00:11:15 executing program 0: syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:15 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:15 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:15 executing program 5: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:15 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x25}, @multicast1, 0x0, 0x2011}}) 00:11:15 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:15 executing program 5: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={0x0, 0x8000, 0x8}, 0xc) 00:11:15 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:15 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1, 0x0, 0x8}, 0xc) 00:11:15 executing program 5: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:16 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:16 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:16 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1}, 0xc) 00:11:16 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:16 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) (async) socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x25}, @multicast1, 0x0, 0x2011}}) (rerun: 64) 00:11:16 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:16 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:16 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:16 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1}, 0xc) 00:11:16 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:16 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:16 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:16 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1}, 0xc) 00:11:16 executing program 1: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:16 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:16 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x25}, @multicast1, 0x0, 0x2011}}) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0x25}, @multicast1, 0x0, 0x2011}}) (async) 00:11:17 executing program 2: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:17 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1}, 0xc) 00:11:17 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:17 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:17 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x4c100, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'tunl0\x00', &(0x7f0000000180)=ANY=[]}) 00:11:17 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:17 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:17 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1}, 0xc) 00:11:17 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, 0x0, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000000c0), 0x0) 00:11:17 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r1}, 0xc) 00:11:17 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:17 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) 00:11:17 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async, rerun: 32) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x4c100, 0x0) (async, rerun: 32) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'tunl0\x00', &(0x7f0000000180)=ANY=[]}) 00:11:17 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (fail_nth: 1) 00:11:17 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0x58, &(0x7f0000000280)}, 0x10) 00:11:17 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) 00:11:17 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:17 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:17 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:17 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:17 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) [ 2763.267978][ T435] FAULT_INJECTION: forcing a failure. [ 2763.267978][ T435] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2763.268011][ T435] CPU: 0 PID: 435 Comm: syz-executor.1 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 00:11:17 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:17 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) [ 2763.268036][ T435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2763.268050][ T435] Call Trace: [ 2763.268057][ T435] [ 2763.268065][ T435] dump_stack_lvl+0xcd/0x134 [ 2763.268110][ T435] should_fail.cold+0x5/0xa [ 2763.268155][ T435] _copy_to_user+0x2a/0x140 [ 2763.268197][ T435] simple_read_from_buffer+0xcc/0x160 [ 2763.268228][ T435] proc_fail_nth_read+0x187/0x220 [ 2763.268257][ T435] ? proc_exe_link+0x1d0/0x1d0 [ 2763.268283][ T435] ? security_file_permission+0xab/0xd0 [ 2763.268317][ T435] ? proc_exe_link+0x1d0/0x1d0 [ 2763.268342][ T435] vfs_read+0x1ef/0x5d0 [ 2763.268371][ T435] ksys_read+0x127/0x250 [ 2763.268395][ T435] ? vfs_write+0xac0/0xac0 [ 2763.268420][ T435] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2763.268467][ T435] do_syscall_64+0x35/0xb0 [ 2763.268496][ T435] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2763.268521][ T435] RIP: 0033:0x7f564723bcbc [ 2763.268541][ T435] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2763.268563][ T435] RSP: 002b:00007f56484c8160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2763.268586][ T435] RAX: ffffffffffffffda RBX: 00007f564739bf60 RCX: 00007f564723bcbc [ 2763.268603][ T435] RDX: 000000000000000f RSI: 00007f56484c81e0 RDI: 0000000000000003 [ 2763.268618][ T435] RBP: 00007f56484c81d0 R08: 0000000000000000 R09: 0000000000000000 [ 2763.268634][ T435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2763.268647][ T435] R13: 00007fff37a200cf R14: 00007f56484c8300 R15: 0000000000022000 [ 2763.268682][ T435] 00:11:18 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x4c100, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'tunl0\x00', &(0x7f0000000180)=ANY=[]}) 00:11:18 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff002, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:18 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:18 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) 00:11:18 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6966, &(0x7f0000000000), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0) 00:11:18 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:18 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) 00:11:18 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:18 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff007, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:18 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff002, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:18 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:18 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x800020ffc000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:18 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, &(0x7f0000000000)={0x3}) r3 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) ioctl$USBDEVFS_BULK(r3, 0xc0185502, &(0x7f00000001c0)={{{0x3, 0x1}}, 0xbc, 0xfffffff7, &(0x7f0000000100)="f2eec3f3581843a966b2653640fc0715748701906059d66d15da8076fcd5851ac6f99e4526caf526695ab3a1bb1120333f8f2e562db62de87e9bfb9363af4d9b49f3b63416b6bc4d052595510873c2696f638b1211c12abc0279b81d6b4a2c31dfcb2478964b52a723b4fcd99fd988844762d8e31e4a90e63f660224deff77f5b27667e9d5e466fadff837001ca1258c74fab69a313311ebbeb6ff4040d86efe6136a0ae96f3259a82cedec890b3f16e89f7f46a12dc114d2d4aaaeb"}) ioctl$USBDEVFS_BULK(r1, 0xc0185502, &(0x7f0000000300)={{{0x1, 0x1}}, 0xdf, 0x7f8, &(0x7f0000000200)="86245bd393f87b17ef5b532cf8a2164c94811e2cb392628ed9174c76acb675188b862a4cf9a5daffbb6a61ee3235d65faf3610818678cfd5c86218ab763bdb2cf86f1fba4629425a11739460f52c2842295c4c75d096522d04cf0c4ec12022f740193201cd18e263a1068239cad33e6151215cae211fc4df7de2ac725ed28dae5367893576b36e65f8fd86410ae1023f3c34cdc8a8167a148b470c3719c6c17ff83db773e7a4852b0a3eb551bc761439c5052ad8501cc43c2e0438c5dbae3449d569bab434214649e5aba3c3e859b33d495df9e464534ad91efb34155c8d07"}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @rand_addr=0x64010102, 0x0, 0x1b}}) 00:11:18 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff002, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:18 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:18 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x4, 0x4, 0x2}, 0x48) 00:11:18 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:18 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:18 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff002, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:18 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x4, 0x4, 0x2}, 0x48) 00:11:18 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:18 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:18 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff007, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:18 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, 0x0) (async) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, &(0x7f0000000000)={0x3}) (async, rerun: 64) r3 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (rerun: 64) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) ioctl$USBDEVFS_BULK(r3, 0xc0185502, &(0x7f00000001c0)={{{0x3, 0x1}}, 0xbc, 0xfffffff7, &(0x7f0000000100)="f2eec3f3581843a966b2653640fc0715748701906059d66d15da8076fcd5851ac6f99e4526caf526695ab3a1bb1120333f8f2e562db62de87e9bfb9363af4d9b49f3b63416b6bc4d052595510873c2696f638b1211c12abc0279b81d6b4a2c31dfcb2478964b52a723b4fcd99fd988844762d8e31e4a90e63f660224deff77f5b27667e9d5e466fadff837001ca1258c74fab69a313311ebbeb6ff4040d86efe6136a0ae96f3259a82cedec890b3f16e89f7f46a12dc114d2d4aaaeb"}) (async, rerun: 32) ioctl$USBDEVFS_BULK(r1, 0xc0185502, &(0x7f0000000300)={{{0x1, 0x1}}, 0xdf, 0x7f8, &(0x7f0000000200)="86245bd393f87b17ef5b532cf8a2164c94811e2cb392628ed9174c76acb675188b862a4cf9a5daffbb6a61ee3235d65faf3610818678cfd5c86218ab763bdb2cf86f1fba4629425a11739460f52c2842295c4c75d096522d04cf0c4ec12022f740193201cd18e263a1068239cad33e6151215cae211fc4df7de2ac725ed28dae5367893576b36e65f8fd86410ae1023f3c34cdc8a8167a148b470c3719c6c17ff83db773e7a4852b0a3eb551bc761439c5052ad8501cc43c2e0438c5dbae3449d569bab434214649e5aba3c3e859b33d495df9e464534ad91efb34155c8d07"}) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @rand_addr=0x64010102, 0x0, 0x1b}}) 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x4, 0x4, 0x2}, 0x48) 00:11:19 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:19 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x800020ffc000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x0, 0x4, 0x2}, 0x48) 00:11:19 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x2, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:19 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:19 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x7, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, 0x0) (async) ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, &(0x7f0000000000)={0x3}) r3 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_BULK(r3, 0xc0185502, &(0x7f00000001c0)={{{0x3, 0x1}}, 0xbc, 0xfffffff7, &(0x7f0000000100)="f2eec3f3581843a966b2653640fc0715748701906059d66d15da8076fcd5851ac6f99e4526caf526695ab3a1bb1120333f8f2e562db62de87e9bfb9363af4d9b49f3b63416b6bc4d052595510873c2696f638b1211c12abc0279b81d6b4a2c31dfcb2478964b52a723b4fcd99fd988844762d8e31e4a90e63f660224deff77f5b27667e9d5e466fadff837001ca1258c74fab69a313311ebbeb6ff4040d86efe6136a0ae96f3259a82cedec890b3f16e89f7f46a12dc114d2d4aaaeb"}) ioctl$USBDEVFS_BULK(r1, 0xc0185502, &(0x7f0000000300)={{{0x1, 0x1}}, 0xdf, 0x7f8, &(0x7f0000000200)="86245bd393f87b17ef5b532cf8a2164c94811e2cb392628ed9174c76acb675188b862a4cf9a5daffbb6a61ee3235d65faf3610818678cfd5c86218ab763bdb2cf86f1fba4629425a11739460f52c2842295c4c75d096522d04cf0c4ec12022f740193201cd18e263a1068239cad33e6151215cae211fc4df7de2ac725ed28dae5367893576b36e65f8fd86410ae1023f3c34cdc8a8167a148b470c3719c6c17ff83db773e7a4852b0a3eb551bc761439c5052ad8501cc43c2e0438c5dbae3449d569bab434214649e5aba3c3e859b33d495df9e464534ad91efb34155c8d07"}) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @rand_addr=0x64010102, 0x0, 0x1b}}) 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (fail_nth: 1) 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x0, 0x4, 0x2}, 0x48) 00:11:19 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 1) 00:11:19 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x700, &(0x7f0000ffb000/0x2000)=nil) [ 2764.894999][ T562] FAULT_INJECTION: forcing a failure. [ 2764.894999][ T562] name fail_usercopy, interval 1, probability 0, space 0, times 0 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x0, 0x4, 0x2}, 0x48) [ 2764.895034][ T562] CPU: 0 PID: 562 Comm: syz-executor.0 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2764.895060][ T562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 00:11:19 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 2) 00:11:19 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x2000000, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x0, 0x2}, 0x48) [ 2764.895072][ T562] Call Trace: 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x3000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) [ 2764.895079][ T562] [ 2764.895087][ T562] dump_stack_lvl+0xcd/0x134 [ 2764.895132][ T562] should_fail.cold+0x5/0xa [ 2764.895177][ T562] _copy_to_user+0x2a/0x140 [ 2764.895216][ T562] simple_read_from_buffer+0xcc/0x160 [ 2764.895244][ T562] proc_fail_nth_read+0x187/0x220 [ 2764.895271][ T562] ? proc_exe_link+0x1d0/0x1d0 [ 2764.895295][ T562] ? security_file_permission+0xab/0xd0 [ 2764.895328][ T562] ? proc_exe_link+0x1d0/0x1d0 [ 2764.895353][ T562] vfs_read+0x1ef/0x5d0 [ 2764.895383][ T562] ksys_read+0x127/0x250 [ 2764.895406][ T562] ? vfs_write+0xac0/0xac0 [ 2764.895430][ T562] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2764.895476][ T562] do_syscall_64+0x35/0xb0 [ 2764.895504][ T562] entry_SYSCALL_64_after_hwframe+0x46/0xb0 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff002, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:19 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x7000000, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x0, 0x2}, 0x48) 00:11:19 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 3) [ 2764.895529][ T562] RIP: 0033:0x7fec32c3bcbc [ 2764.895548][ T562] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 00:11:19 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:19 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x200000000000000, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff007, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000240)=0xb78b) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002bbd7000fddbdf2505000000050005000100006b4308167480ca6488666f000500050001223b60f205e25430"], 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x20000000) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r5, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xf3}]}, 0x48}, 0x1, 0x0, 0x0, 0x4010}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x6, 0x2013}}) socket(0x2a, 0x1, 0x54e3) 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x0, 0x2}, 0x48) 00:11:19 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 4) [ 2764.895577][ T562] RSP: 002b:00007fec33d7b160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x800000000000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x700000000000000, &(0x7f0000ffb000/0x2000)=nil) 00:11:19 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 5) 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4}, 0x48) [ 2764.895601][ T562] RAX: ffffffffffffffda RBX: 00007fec32d9bf60 RCX: 00007fec32c3bcbc [ 2764.895619][ T562] RDX: 000000000000000f RSI: 00007fec33d7b1e0 RDI: 0000000000000003 00:11:19 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:19 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff00f, 0x0, &(0x7f0000ffb000/0x2000)=nil) [ 2764.895635][ T562] RBP: 00007fec33d7b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2764.895650][ T562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 00:11:19 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4}, 0x48) [ 2764.895666][ T562] R13: 00007ffd03b04a8f R14: 00007fec33d7b300 R15: 0000000000022000 00:11:19 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 6) 00:11:20 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_RESET(r1, 0x5514) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000700)={0x0, 0x8, 0x0, &(0x7f0000000200)=[{}, {0x80000000}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000500)=[{}, {}], 0x0, 0x0, &(0x7f0000000980), 0x0, 0x0, &(0x7f0000000b00)}) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, &(0x7f0000000780)={r2}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r3 = userfaultfd(0x800) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x2}) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x8, 0x2, 0x10}) r4 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r4) setsockopt$MRT_DONE(r4, 0x0, 0xc9, 0x0, 0x0) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, r5, 0x0, &(0x7f0000000040)='./file0\x00', 0x1, 0x0, 0x12345}, 0x7) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f0000000b00)=ANY=[@ANYBLOB="00042be9c74590846cc6908c2e9694363350afda0b8b50b44800008bfb486973ce5443f40469e847d9455600fef756e9f010879eacde4e02258e25f62d15ce1fed5fb9b78b62e0c3b194f78c43ffabbc04e52b82cef0246c6b41e51d764376fd472b78738b23b7207c4d76ec980d27b5da09ca24e9c493186fa84bf8cec269297959b4d967fb5cc4e3b02961acb43da058997a45c8ce2ce259a18c11c2140bd37ef82dc2213ebad81f02200dce834d35ba23013d523be073ad856b3e3d1c8b1d55c9f3a4c8a3032363d117bd8823aae3c4236014470bfc6af73e9422748508094f0867b3718c26495d13adbc65ce6151a023181f8302ddeb6216513df5760465702f6dfa1c63c802c272bb8c2e63e4d482debf7d", @ANYRES16=0x0, @ANYBLOB="020028bd7000fbdbdf04be8b6200000000074100000014225f477500386db67ef8879b57c462b116543eea1b565ef619a3083de9c80e9fb4dde0942e6caeb7cba9243e6663756f6c1a241de068978632daa63a780d000000003ababbefb9a56aa4b1525e1a16d8db2d46f02f38eae5b73aa4e59481e62b5d8970d15970"], 0x30}, 0x1, 0x0, 0x0, 0x10000000}, 0x80) r6 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x101040, 0x0) getsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f0000000180), &(0x7f00000001c0)=0x4) [ 2764.895702][ T562] [ 2764.964929][ T569] FAULT_INJECTION: forcing a failure. [ 2764.964929][ T569] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2764.964960][ T569] CPU: 0 PID: 569 Comm: syz-executor.4 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2764.964984][ T569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2764.964996][ T569] Call Trace: [ 2764.965003][ T569] 00:11:20 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000240)=0xb78b) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) (async, rerun: 64) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) (rerun: 64) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002bbd7000fddbdf2505000000050005000100006b4308167480ca6488666f000500050001223b60f205e25430"], 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x20000000) (async, rerun: 64) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r5, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xf3}]}, 0x48}, 0x1, 0x0, 0x0, 0x4010}, 0x10) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x6, 0x2013}}) (async) socket(0x2a, 0x1, 0x54e3) 00:11:20 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:20 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x2, &(0x7f0000ffb000/0x2000)=nil) 00:11:20 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_RESET(r1, 0x5514) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000700)={0x0, 0x8, 0x0, &(0x7f0000000200)=[{}, {0x80000000}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000500)=[{}, {}], 0x0, 0x0, &(0x7f0000000980), 0x0, 0x0, &(0x7f0000000b00)}) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, &(0x7f0000000780)={r2}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r3 = userfaultfd(0x800) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x2}) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x8, 0x2, 0x10}) r4 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r4) setsockopt$MRT_DONE(r4, 0x0, 0xc9, 0x0, 0x0) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, r5, 0x0, &(0x7f0000000040)='./file0\x00', 0x1, 0x0, 0x12345}, 0x7) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f0000000b00)=ANY=[@ANYBLOB="00042be9c74590846cc6908c2e9694363350afda0b8b50b44800008bfb486973ce5443f40469e847d9455600fef756e9f010879eacde4e02258e25f62d15ce1fed5fb9b78b62e0c3b194f78c43ffabbc04e52b82cef0246c6b41e51d764376fd472b78738b23b7207c4d76ec980d27b5da09ca24e9c493186fa84bf8cec269297959b4d967fb5cc4e3b02961acb43da058997a45c8ce2ce259a18c11c2140bd37ef82dc2213ebad81f02200dce834d35ba23013d523be073ad856b3e3d1c8b1d55c9f3a4c8a3032363d117bd8823aae3c4236014470bfc6af73e9422748508094f0867b3718c26495d13adbc65ce6151a023181f8302ddeb6216513df5760465702f6dfa1c63c802c272bb8c2e63e4d482debf7d", @ANYRES16=0x0, @ANYBLOB="020028bd7000fbdbdf04be8b6200000000074100000014225f477500386db67ef8879b57c462b116543eea1b565ef619a3083de9c80e9fb4dde0942e6caeb7cba9243e6663756f6c1a241de068978632daa63a780d000000003ababbefb9a56aa4b1525e1a16d8db2d46f02f38eae5b73aa4e59481e62b5d8970d15970"], 0x30}, 0x1, 0x0, 0x0, 0x10000000}, 0x80) r6 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x101040, 0x0) getsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f0000000180), &(0x7f00000001c0)=0x4) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_RESET(r1, 0x5514) (async) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000700)={0x0, 0x8, 0x0, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000500)=[{}, {}], 0x0, 0x0, &(0x7f0000000980), 0x0, 0x0, &(0x7f0000000b00)}) (async) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, &(0x7f0000000780)={r2}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) userfaultfd(0x800) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x2}) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x8, 0x2, 0x10}) (async) socket$igmp(0x2, 0x3, 0x2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r4) (async) setsockopt$MRT_DONE(r4, 0x0, 0xc9, 0x0, 0x0) (async) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, r5, 0x0, &(0x7f0000000040)='./file0\x00', 0x1, 0x0, 0x12345}, 0x7) (async) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f0000000b00)=ANY=[@ANYBLOB="00042be9c74590846cc6908c2e9694363350afda0b8b50b44800008bfb486973ce5443f40469e847d9455600fef756e9f010879eacde4e02258e25f62d15ce1fed5fb9b78b62e0c3b194f78c43ffabbc04e52b82cef0246c6b41e51d764376fd472b78738b23b7207c4d76ec980d27b5da09ca24e9c493186fa84bf8cec269297959b4d967fb5cc4e3b02961acb43da058997a45c8ce2ce259a18c11c2140bd37ef82dc2213ebad81f02200dce834d35ba23013d523be073ad856b3e3d1c8b1d55c9f3a4c8a3032363d117bd8823aae3c4236014470bfc6af73e9422748508094f0867b3718c26495d13adbc65ce6151a023181f8302ddeb6216513df5760465702f6dfa1c63c802c272bb8c2e63e4d482debf7d", @ANYRES16=0x0, @ANYBLOB="020028bd7000fbdbdf04be8b6200000000074100000014225f477500386db67ef8879b57c462b116543eea1b565ef619a3083de9c80e9fb4dde0942e6caeb7cba9243e6663756f6c1a241de068978632daa63a780d000000003ababbefb9a56aa4b1525e1a16d8db2d46f02f38eae5b73aa4e59481e62b5d8970d15970"], 0x30}, 0x1, 0x0, 0x0, 0x10000000}, 0x80) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x101040, 0x0) (async) getsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f0000000180), &(0x7f00000001c0)=0x4) (async) 00:11:20 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4}, 0x48) 00:11:20 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 7) [ 2764.965011][ T569] dump_stack_lvl+0xcd/0x134 [ 2764.965053][ T569] should_fail.cold+0x5/0xa [ 2764.965089][ T569] _copy_from_user+0x2a/0x170 [ 2764.965125][ T569] io_uring_setup+0x86/0x150 [ 2764.965161][ T569] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 00:11:20 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x7, &(0x7f0000ffb000/0x2000)=nil) 00:11:20 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) [ 2764.965191][ T569] ? io_cqring_overflow_flush+0x140/0x140 00:11:20 executing program 2: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:20 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_RESET(r1, 0x5514) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000700)={0x0, 0x8, 0x0, &(0x7f0000000200)=[{}, {0x80000000}, {}, {}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000500)=[{}, {}], 0x0, 0x0, &(0x7f0000000980), 0x0, 0x0, &(0x7f0000000b00)}) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, &(0x7f0000000780)={r2}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r3 = userfaultfd(0x800) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x2}) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x8, 0x2, 0x10}) (async) r4 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r4) (async) setsockopt$MRT_DONE(r4, 0x0, 0xc9, 0x0, 0x0) (async) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1) (async) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, r5, 0x0, &(0x7f0000000040)='./file0\x00', 0x1, 0x0, 0x12345}, 0x7) (async) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f0000000b00)=ANY=[@ANYBLOB="00042be9c74590846cc6908c2e9694363350afda0b8b50b44800008bfb486973ce5443f40469e847d9455600fef756e9f010879eacde4e02258e25f62d15ce1fed5fb9b78b62e0c3b194f78c43ffabbc04e52b82cef0246c6b41e51d764376fd472b78738b23b7207c4d76ec980d27b5da09ca24e9c493186fa84bf8cec269297959b4d967fb5cc4e3b02961acb43da058997a45c8ce2ce259a18c11c2140bd37ef82dc2213ebad81f02200dce834d35ba23013d523be073ad856b3e3d1c8b1d55c9f3a4c8a3032363d117bd8823aae3c4236014470bfc6af73e9422748508094f0867b3718c26495d13adbc65ce6151a023181f8302ddeb6216513df5760465702f6dfa1c63c802c272bb8c2e63e4d482debf7d", @ANYRES16=0x0, @ANYBLOB="020028bd7000fbdbdf04be8b6200000000074100000014225f477500386db67ef8879b57c462b116543eea1b565ef619a3083de9c80e9fb4dde0942e6caeb7cba9243e6663756f6c1a241de068978632daa63a780d000000003ababbefb9a56aa4b1525e1a16d8db2d46f02f38eae5b73aa4e59481e62b5d8970d15970"], 0x30}, 0x1, 0x0, 0x0, 0x10000000}, 0x80) (async) r6 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x101040, 0x0) getsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 00:11:20 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 8) 00:11:20 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r2, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000240)=0xb78b) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) (async) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002bbd7000fddbdf2505000000050005000100006b4308167480ca6488666f000500050001223b60f205e25430"], 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x20000000) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, r5, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xf3}]}, 0x48}, 0x1, 0x0, 0x0, 0x4010}, 0x10) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x6, 0x2013}}) (rerun: 64) socket(0x2a, 0x1, 0x54e3) [ 2764.965231][ T569] ? lockdep_hardirqs_on+0x79/0x100 [ 2764.965267][ T569] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 2764.965305][ T569] ? syscall_enter_from_user_mode+0x2c/0xb0 00:11:20 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x700, &(0x7f0000ffb000/0x2000)=nil) [ 2764.965343][ T569] do_syscall_64+0x35/0xb0 [ 2764.965371][ T569] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2764.965394][ T569] RIP: 0033:0x7fecff489109 00:11:20 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 9) 00:11:20 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 1) 00:11:20 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x2000000, &(0x7f0000ffb000/0x2000)=nil) 00:11:20 executing program 1: mremap(&(0x7f0000ff1000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) mremap(&(0x7f0000ff5000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000680)={{&(0x7f0000fec000/0x3000)=nil, 0x3000}, 0x1}) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000006c0)={0x7}) munlock(&(0x7f0000ff7000/0x1000)=nil, 0x1000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$usbfs(&(0x7f0000ff2000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x800) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000004c0), 0x2083) syz_io_uring_setup(0x43dc, &(0x7f0000000280)={0x0, 0xdcb0, 0x2, 0x0, 0x35b, 0x0, r0}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/165, 0xa5, 0x0, &(0x7f00000000c0)=""/182, 0xb6}, &(0x7f00000001c0)=0x40) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080) ioctl$SOUND_MIXER_INFO(0xffffffffffffffff, 0x805c4d65, &(0x7f0000000200)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000500)="c4962aa1ae8928c52a94788bfe6c9dbdd902dae904d2a668cad916be6bf28d0fd5b81eb571af3d8d029e1ac4137328074f96ddc7d2684f07a4c4448c108b6ff5888ad1beff1fbd8c7069ca7f1c1c677b939e9b0b196db0106e4fb068eb60c586a58323f8e7054d64c320f2d092b8633729d83672e1f547dd01b7e14682b0481806ceca7d84a21ce200ddb05bcef90462fe8ecbfbdefc224b282c24b99a7497c08ce8de6c247c1ec2a0e17ed3b0f0454f23d03d5588bd1b58431e553a830f31b6e6b21729", &(0x7f0000000600)=@udp=r0, 0x2}, 0x20) 00:11:20 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 1) [ 2764.965413][ T569] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 00:11:20 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000000), &(0x7f00000000c0)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1, @loopback, 0xffff, 0x2011}}) 00:11:20 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 10) 00:11:20 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x7000000, &(0x7f0000ffb000/0x2000)=nil) 00:11:20 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 2) [ 2764.965435][ T569] RSP: 002b:00007fed0058e0e8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 2764.965459][ T569] RAX: ffffffffffffffda RBX: 00007fecff59bf60 RCX: 00007fecff489109 00:11:20 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 2) 00:11:20 executing program 1: mremap(&(0x7f0000ff1000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) mremap(&(0x7f0000ff5000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000680)={{&(0x7f0000fec000/0x3000)=nil, 0x3000}, 0x1}) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000006c0)={0x7}) munlock(&(0x7f0000ff7000/0x1000)=nil, 0x1000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$usbfs(&(0x7f0000ff2000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x800) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000004c0), 0x2083) syz_io_uring_setup(0x43dc, &(0x7f0000000280)={0x0, 0xdcb0, 0x2, 0x0, 0x35b, 0x0, r0}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/165, 0xa5, 0x0, &(0x7f00000000c0)=""/182, 0xb6}, &(0x7f00000001c0)=0x40) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080) ioctl$SOUND_MIXER_INFO(0xffffffffffffffff, 0x805c4d65, &(0x7f0000000200)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000500)="c4962aa1ae8928c52a94788bfe6c9dbdd902dae904d2a668cad916be6bf28d0fd5b81eb571af3d8d029e1ac4137328074f96ddc7d2684f07a4c4448c108b6ff5888ad1beff1fbd8c7069ca7f1c1c677b939e9b0b196db0106e4fb068eb60c586a58323f8e7054d64c320f2d092b8633729d83672e1f547dd01b7e14682b0481806ceca7d84a21ce200ddb05bcef90462fe8ecbfbdefc224b282c24b99a7497c08ce8de6c247c1ec2a0e17ed3b0f0454f23d03d5588bd1b58431e553a830f31b6e6b21729", &(0x7f0000000600)=@udp=r0, 0x2}, 0x20) mremap(&(0x7f0000ff1000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) (async) mremap(&(0x7f0000ff5000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000680)={{&(0x7f0000fec000/0x3000)=nil, 0x3000}, 0x1}) (async) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000006c0)={0x7}) (async) munlock(&(0x7f0000ff7000/0x1000)=nil, 0x1000) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$usbfs(&(0x7f0000ff2000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x800) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000004c0), 0x2083) (async) syz_io_uring_setup(0x43dc, &(0x7f0000000280)={0x0, 0xdcb0, 0x2, 0x0, 0x35b, 0x0, r0}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/165, 0xa5, 0x0, &(0x7f00000000c0)=""/182, 0xb6}, &(0x7f00000001c0)=0x40) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r0) (async) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080) (async) ioctl$SOUND_MIXER_INFO(0xffffffffffffffff, 0x805c4d65, &(0x7f0000000200)) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000500)="c4962aa1ae8928c52a94788bfe6c9dbdd902dae904d2a668cad916be6bf28d0fd5b81eb571af3d8d029e1ac4137328074f96ddc7d2684f07a4c4448c108b6ff5888ad1beff1fbd8c7069ca7f1c1c677b939e9b0b196db0106e4fb068eb60c586a58323f8e7054d64c320f2d092b8633729d83672e1f547dd01b7e14682b0481806ceca7d84a21ce200ddb05bcef90462fe8ecbfbdefc224b282c24b99a7497c08ce8de6c247c1ec2a0e17ed3b0f0454f23d03d5588bd1b58431e553a830f31b6e6b21729", &(0x7f0000000600)=@udp=r0, 0x2}, 0x20) (async) [ 2764.965475][ T569] RDX: 0000000020ffb000 RSI: 00000000200000c0 RDI: 00000000000043c6 [ 2764.965491][ T569] RBP: 00000000200000c0 R08: 0000000020000180 R09: 0000000020000180 00:11:20 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x200000000000000, &(0x7f0000ffb000/0x2000)=nil) 00:11:20 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 11) 00:11:20 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 3) 00:11:20 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 3) [ 2764.965506][ T569] R10: 0000000020000140 R11: 0000000000000206 R12: 0000000020000180 [ 2764.965521][ T569] R13: 0000000020ffb000 R14: 0000000020000140 R15: 0000000020ffc000 00:11:20 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x700000000000000, &(0x7f0000ffb000/0x2000)=nil) 00:11:20 executing program 1: mremap(&(0x7f0000ff1000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) (async) mremap(&(0x7f0000ff5000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 32) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000680)={{&(0x7f0000fec000/0x3000)=nil, 0x3000}, 0x1}) (async, rerun: 32) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000006c0)={0x7}) (async) munlock(&(0x7f0000ff7000/0x1000)=nil, 0x1000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async, rerun: 64) mmap$usbfs(&(0x7f0000ff2000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x800) (async, rerun: 64) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000004c0), 0x2083) (async) syz_io_uring_setup(0x43dc, &(0x7f0000000280)={0x0, 0xdcb0, 0x2, 0x0, 0x35b, 0x0, r0}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/165, 0xa5, 0x0, &(0x7f00000000c0)=""/182, 0xb6}, &(0x7f00000001c0)=0x40) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async, rerun: 32) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r0) (rerun: 32) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080) (async) ioctl$SOUND_MIXER_INFO(0xffffffffffffffff, 0x805c4d65, &(0x7f0000000200)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000500)="c4962aa1ae8928c52a94788bfe6c9dbdd902dae904d2a668cad916be6bf28d0fd5b81eb571af3d8d029e1ac4137328074f96ddc7d2684f07a4c4448c108b6ff5888ad1beff1fbd8c7069ca7f1c1c677b939e9b0b196db0106e4fb068eb60c586a58323f8e7054d64c320f2d092b8633729d83672e1f547dd01b7e14682b0481806ceca7d84a21ce200ddb05bcef90462fe8ecbfbdefc224b282c24b99a7497c08ce8de6c247c1ec2a0e17ed3b0f0454f23d03d5588bd1b58431e553a830f31b6e6b21729", &(0x7f0000000600)=@udp=r0, 0x2}, 0x20) [ 2764.965562][ T569] [ 2765.382677][ T602] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. 00:11:20 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000000), &(0x7f00000000c0)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1, @loopback, 0xffff, 0x2011}}) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) getsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000000), &(0x7f00000000c0)=0x4) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1, @loopback, 0xffff, 0x2011}}) (async) 00:11:20 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 4) 00:11:20 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 12) 00:11:20 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 4) [ 2766.015827][ T675] FAULT_INJECTION: forcing a failure. [ 2766.015827][ T675] name fail_usercopy, interval 1, probability 0, space 0, times 0 00:11:20 executing program 0: r0 = socket(0x25, 0x6, 0xffffffff) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x4000, 0x7, &(0x7f0000ffb000/0x4000)=nil) 00:11:20 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 5) 00:11:20 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000003, 0x4000010, r0, 0x0) syz_io_uring_setup(0x4756c, &(0x7f0000000000)={0x0, 0x9d47, 0x8, 0x3, 0x2b1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_OPENAT={0x12, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000100)='./file0\x00', 0x20, 0x10000, 0x12345}, 0x7fff) mmap$qrtrtun(&(0x7f0000ff3000/0xb000)=nil, 0xb000, 0x4, 0x40010, 0xffffffffffffffff, 0x2) munlock(&(0x7f0000ff4000/0x3000)=nil, 0x3000) [ 2766.015861][ T675] CPU: 0 PID: 675 Comm: syz-executor.5 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2766.015885][ T675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 00:11:20 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 5) 00:11:20 executing program 0: r0 = socket(0x25, 0x6, 0xffffffff) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x4000, 0x7, &(0x7f0000ffb000/0x4000)=nil) socket(0x25, 0x6, 0xffffffff) (async) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x4000, 0x7, &(0x7f0000ffb000/0x4000)=nil) (async) 00:11:20 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 13) 00:11:20 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000000), &(0x7f00000000c0)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1, @loopback, 0xffff, 0x2011}}) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) getsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000000), &(0x7f00000000c0)=0x4) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1, @loopback, 0xffff, 0x2011}}) (async) [ 2766.015899][ T675] Call Trace: [ 2766.015906][ T675] [ 2766.015914][ T675] dump_stack_lvl+0xcd/0x134 [ 2766.015958][ T675] should_fail.cold+0x5/0xa 00:11:21 executing program 0: r0 = socket(0x25, 0x6, 0xffffffff) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x4000, 0x7, &(0x7f0000ffb000/0x4000)=nil) socket(0x25, 0x6, 0xffffffff) (async) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x4000, 0x7, &(0x7f0000ffb000/0x4000)=nil) (async) 00:11:21 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 6) 00:11:21 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000003, 0x4000010, r0, 0x0) syz_io_uring_setup(0x4756c, &(0x7f0000000000)={0x0, 0x9d47, 0x8, 0x3, 0x2b1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_OPENAT={0x12, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000100)='./file0\x00', 0x20, 0x10000, 0x12345}, 0x7fff) mmap$qrtrtun(&(0x7f0000ff3000/0xb000)=nil, 0xb000, 0x4, 0x40010, 0xffffffffffffffff, 0x2) munlock(&(0x7f0000ff4000/0x3000)=nil, 0x3000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000003, 0x4000010, r0, 0x0) (async) syz_io_uring_setup(0x4756c, &(0x7f0000000000)={0x0, 0x9d47, 0x8, 0x3, 0x2b1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0) (async) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_OPENAT={0x12, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000100)='./file0\x00', 0x20, 0x10000, 0x12345}, 0x7fff) (async) mmap$qrtrtun(&(0x7f0000ff3000/0xb000)=nil, 0xb000, 0x4, 0x40010, 0xffffffffffffffff, 0x2) (async) munlock(&(0x7f0000ff4000/0x3000)=nil, 0x3000) (async) 00:11:21 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 14) [ 2766.015993][ T675] _copy_from_user+0x2a/0x170 00:11:21 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 6) [ 2766.016032][ T675] io_uring_setup+0x86/0x150 [ 2766.016073][ T675] ? io_cqring_overflow_flush+0x140/0x140 [ 2766.016122][ T675] ? syscall_enter_from_user_mode+0x22/0xb0 00:11:21 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 7) 00:11:21 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100)=[@window, @timestamp, @sack_perm, @mss], 0x4) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f00000000c0)={{{0x2, 0x1}}, 0xee, 0x4, &(0x7f0000000140)="00225c752219b89052e515a67a6420bb97826ded9a4d5c0f7b5ffeb7a738ffe0876dc3f647c12d1d3ac017ed2ef9caa27f4480c0c1b26efba35480145ec389802054a1994419838babebb2a72b41838057f35730e81019069c4f23157c8d11c72732071f7c8088ed5d15f13c4c60f4647e8706e86a3acc9d1ec7f5af947fe160656cebae28dcbb177f4a8d1b67f9d4d7ad29334cc8a7bc58ee8b2054213c49c7d2b8586aed30a9663af2d70cfb0b28c4f506f3af1a11560154a0158254947b838f46c5e260a3c115872b0fa20ecea3ada82ca2d120dcc26a0740b156d6bb5cd1bc6844df4181e16becce6b2de86a"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x40, 0x1, 0x8, 0x0, {{0x3b, 0x4, 0x2, 0x3, 0xec, 0x68, 0x0, 0x7, 0x29, 0x0, @rand_addr=0x64010102, @local, {[@ssrr={0x89, 0x2b, 0x2e, [@rand_addr=0x64010102, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @broadcast, @local, @loopback]}, @timestamp={0x44, 0x14, 0xb0, 0x0, 0x6, [0x6, 0x6, 0x5, 0xeb]}, @timestamp_prespec={0x44, 0x3c, 0x8c, 0x3, 0x5, [{@multicast1}, {@empty}, {@rand_addr=0x64010100, 0x10000}, {@broadcast, 0xff45}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xedf3}, {@remote}, {@multicast1, 0xa091}]}, @cipso={0x86, 0x2d, 0x2, [{0x6, 0x11, "177b8481bf6698a0da9fe15b2b13c6"}, {0x0, 0x6, "79740aaf"}, {0x5, 0x10, "ab29f7fdf132f291771a3591ab31"}]}, @ssrr={0x89, 0xb, 0x83, [@dev={0xac, 0x14, 0x14, 0x1a}, @multicast2]}, @timestamp_addr={0x44, 0x24, 0xc5, 0x1, 0xa, [{@dev={0xac, 0x14, 0x14, 0x1b}, 0x1}, {@remote, 0x3f}, {@multicast2, 0x4}, {@loopback, 0x6}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x2011}}) 00:11:21 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 7) 00:11:21 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 15) 00:11:21 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) mmap$usbfs(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x10, r0, 0x8) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000000)={0x7dd, 0x13, [{0x0, 0x1}, {0x0, 0x1}, {0x9}, {0x7, 0x1}, {0xc}, {0xc, 0x1}, {0xc}, {0x1}, {0x5}, {0xc, 0x1}, {0xd, 0x1}, {0x8}, {0xf, 0x1}, {0xb, 0x1}, {0x9, 0x1}, {0xe}, {0x5}, {0xc, 0x1}, {0xb}]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) [ 2766.016160][ T675] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2766.016204][ T675] do_syscall_64+0x35/0xb0 [ 2766.016229][ T675] entry_SYSCALL_64_after_hwframe+0x46/0xb0 00:11:21 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000003, 0x4000010, r0, 0x0) (async) syz_io_uring_setup(0x4756c, &(0x7f0000000000)={0x0, 0x9d47, 0x8, 0x3, 0x2b1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0) (async) syz_io_uring_submit(r1, 0x0, &(0x7f0000000140)=@IORING_OP_OPENAT={0x12, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000100)='./file0\x00', 0x20, 0x10000, 0x12345}, 0x7fff) (async) mmap$qrtrtun(&(0x7f0000ff3000/0xb000)=nil, 0xb000, 0x4, 0x40010, 0xffffffffffffffff, 0x2) munlock(&(0x7f0000ff4000/0x3000)=nil, 0x3000) 00:11:21 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 8) 00:11:21 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) mmap$usbfs(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x10, r0, 0x8) (async) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000000)={0x7dd, 0x13, [{0x0, 0x1}, {0x0, 0x1}, {0x9}, {0x7, 0x1}, {0xc}, {0xc, 0x1}, {0xc}, {0x1}, {0x5}, {0xc, 0x1}, {0xd, 0x1}, {0x8}, {0xf, 0x1}, {0xb, 0x1}, {0x9, 0x1}, {0xe}, {0x5}, {0xc, 0x1}, {0xb}]}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) [ 2766.016254][ T675] RIP: 0033:0x7fc8fc089109 [ 2766.016274][ T675] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 00:11:21 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 8) 00:11:21 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 16) 00:11:21 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) (fail_nth: 9) [ 2766.016295][ T675] RSP: 002b:00007fc8fd2910e8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 00:11:21 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) mmap$dsp(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000001, 0x101090, r0, 0x0) 00:11:21 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) mmap$usbfs(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x10, r0, 0x8) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000000)={0x7dd, 0x13, [{0x0, 0x1}, {0x0, 0x1}, {0x9}, {0x7, 0x1}, {0xc}, {0xc, 0x1}, {0xc}, {0x1}, {0x5}, {0xc, 0x1}, {0xd, 0x1}, {0x8}, {0xf, 0x1}, {0xb, 0x1}, {0x9, 0x1}, {0xe}, {0x5}, {0xc, 0x1}, {0xb}]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) [ 2766.016317][ T675] RAX: ffffffffffffffda RBX: 00007fc8fc19bf60 RCX: 00007fc8fc089109 [ 2766.016333][ T675] RDX: 0000000020ffb000 RSI: 00000000200000c0 RDI: 00000000000043c6 [ 2766.016347][ T675] RBP: 00000000200000c0 R08: 0000000020000180 R09: 0000000020000180 00:11:21 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100)=[@window, @timestamp, @sack_perm, @mss], 0x4) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f00000000c0)={{{0x2, 0x1}}, 0xee, 0x4, &(0x7f0000000140)="00225c752219b89052e515a67a6420bb97826ded9a4d5c0f7b5ffeb7a738ffe0876dc3f647c12d1d3ac017ed2ef9caa27f4480c0c1b26efba35480145ec389802054a1994419838babebb2a72b41838057f35730e81019069c4f23157c8d11c72732071f7c8088ed5d15f13c4c60f4647e8706e86a3acc9d1ec7f5af947fe160656cebae28dcbb177f4a8d1b67f9d4d7ad29334cc8a7bc58ee8b2054213c49c7d2b8586aed30a9663af2d70cfb0b28c4f506f3af1a11560154a0158254947b838f46c5e260a3c115872b0fa20ecea3ada82ca2d120dcc26a0740b156d6bb5cd1bc6844df4181e16becce6b2de86a"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x40, 0x1, 0x8, 0x0, {{0x3b, 0x4, 0x2, 0x3, 0xec, 0x68, 0x0, 0x7, 0x29, 0x0, @rand_addr=0x64010102, @local, {[@ssrr={0x89, 0x2b, 0x2e, [@rand_addr=0x64010102, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @broadcast, @local, @loopback]}, @timestamp={0x44, 0x14, 0xb0, 0x0, 0x6, [0x6, 0x6, 0x5, 0xeb]}, @timestamp_prespec={0x44, 0x3c, 0x8c, 0x3, 0x5, [{@multicast1}, {@empty}, {@rand_addr=0x64010100, 0x10000}, {@broadcast, 0xff45}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xedf3}, {@remote}, {@multicast1, 0xa091}]}, @cipso={0x86, 0x2d, 0x2, [{0x6, 0x11, "177b8481bf6698a0da9fe15b2b13c6"}, {0x0, 0x6, "79740aaf"}, {0x5, 0x10, "ab29f7fdf132f291771a3591ab31"}]}, @ssrr={0x89, 0xb, 0x83, [@dev={0xac, 0x14, 0x14, 0x1a}, @multicast2]}, @timestamp_addr={0x44, 0x24, 0xc5, 0x1, 0xa, [{@dev={0xac, 0x14, 0x14, 0x1b}, 0x1}, {@remote, 0x3f}, {@multicast2, 0x4}, {@loopback, 0x6}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x2011}}) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100)=[@window, @timestamp, @sack_perm, @mss], 0x4) (async) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f00000000c0)={{{0x2, 0x1}}, 0xee, 0x4, &(0x7f0000000140)="00225c752219b89052e515a67a6420bb97826ded9a4d5c0f7b5ffeb7a738ffe0876dc3f647c12d1d3ac017ed2ef9caa27f4480c0c1b26efba35480145ec389802054a1994419838babebb2a72b41838057f35730e81019069c4f23157c8d11c72732071f7c8088ed5d15f13c4c60f4647e8706e86a3acc9d1ec7f5af947fe160656cebae28dcbb177f4a8d1b67f9d4d7ad29334cc8a7bc58ee8b2054213c49c7d2b8586aed30a9663af2d70cfb0b28c4f506f3af1a11560154a0158254947b838f46c5e260a3c115872b0fa20ecea3ada82ca2d120dcc26a0740b156d6bb5cd1bc6844df4181e16becce6b2de86a"}) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x40, 0x1, 0x8, 0x0, {{0x3b, 0x4, 0x2, 0x3, 0xec, 0x68, 0x0, 0x7, 0x29, 0x0, @rand_addr=0x64010102, @local, {[@ssrr={0x89, 0x2b, 0x2e, [@rand_addr=0x64010102, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @broadcast, @local, @loopback]}, @timestamp={0x44, 0x14, 0xb0, 0x0, 0x6, [0x6, 0x6, 0x5, 0xeb]}, @timestamp_prespec={0x44, 0x3c, 0x8c, 0x3, 0x5, [{@multicast1}, {@empty}, {@rand_addr=0x64010100, 0x10000}, {@broadcast, 0xff45}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xedf3}, {@remote}, {@multicast1, 0xa091}]}, @cipso={0x86, 0x2d, 0x2, [{0x6, 0x11, "177b8481bf6698a0da9fe15b2b13c6"}, {0x0, 0x6, "79740aaf"}, {0x5, 0x10, "ab29f7fdf132f291771a3591ab31"}]}, @ssrr={0x89, 0xb, 0x83, [@dev={0xac, 0x14, 0x14, 0x1a}, @multicast2]}, @timestamp_addr={0x44, 0x24, 0xc5, 0x1, 0xa, [{@dev={0xac, 0x14, 0x14, 0x1b}, 0x1}, {@remote, 0x3f}, {@multicast2, 0x4}, {@loopback, 0x6}]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x2011}}) (async) 00:11:21 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 9) 00:11:21 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) mmap$dsp(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000001, 0x101090, r0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) (async) mmap$dsp(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000001, 0x101090, r0, 0x0) (async) 00:11:21 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:21 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 17) 00:11:21 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0xc8241, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd29}, 0x1c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r3, 0x400, 0x70bd2d, 0x25dfdbfd, {{}, {}, {0x20, 0x17, {0x2, 0xffffffff, @l2={'eth', 0x3a, 'veth0_to_batadv\x00'}}}}, ["", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008816}, 0x20000800) munlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) mmap$dsp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000001, 0x1010, r0, 0x0) [ 2766.016362][ T675] R10: 0000000020000140 R11: 0000000000000206 R12: 0000000020000180 [ 2766.016377][ T675] R13: 0000000020ffb000 R14: 0000000020000140 R15: 0000000020ffc000 00:11:21 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) mmap$dsp(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000001, 0x101090, r0, 0x0) 00:11:21 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 18) [ 2766.016408][ T675] [ 2766.031982][ T683] FAULT_INJECTION: forcing a failure. [ 2766.031982][ T683] name fail_usercopy, interval 1, probability 0, space 0, times 0 00:11:21 executing program 2: bpf$MAP_CREATE(0x2, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:21 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 10) [ 2766.032014][ T683] CPU: 1 PID: 683 Comm: syz-executor.2 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 00:11:21 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0xc8241, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd29}, 0x1c}}, 0x0) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r3, 0x400, 0x70bd2d, 0x25dfdbfd, {{}, {}, {0x20, 0x17, {0x2, 0xffffffff, @l2={'eth', 0x3a, 'veth0_to_batadv\x00'}}}}, ["", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008816}, 0x20000800) (async) munlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) (async) mmap$dsp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000001, 0x1010, r0, 0x0) [ 2766.032041][ T683] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 00:11:21 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100)=[@window, @timestamp, @sack_perm, @mss], 0x4) (async) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f00000000c0)={{{0x2, 0x1}}, 0xee, 0x4, &(0x7f0000000140)="00225c752219b89052e515a67a6420bb97826ded9a4d5c0f7b5ffeb7a738ffe0876dc3f647c12d1d3ac017ed2ef9caa27f4480c0c1b26efba35480145ec389802054a1994419838babebb2a72b41838057f35730e81019069c4f23157c8d11c72732071f7c8088ed5d15f13c4c60f4647e8706e86a3acc9d1ec7f5af947fe160656cebae28dcbb177f4a8d1b67f9d4d7ad29334cc8a7bc58ee8b2054213c49c7d2b8586aed30a9663af2d70cfb0b28c4f506f3af1a11560154a0158254947b838f46c5e260a3c115872b0fa20ecea3ada82ca2d120dcc26a0740b156d6bb5cd1bc6844df4181e16becce6b2de86a"}) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x40, 0x1, 0x8, 0x0, {{0x3b, 0x4, 0x2, 0x3, 0xec, 0x68, 0x0, 0x7, 0x29, 0x0, @rand_addr=0x64010102, @local, {[@ssrr={0x89, 0x2b, 0x2e, [@rand_addr=0x64010102, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @broadcast, @local, @loopback]}, @timestamp={0x44, 0x14, 0xb0, 0x0, 0x6, [0x6, 0x6, 0x5, 0xeb]}, @timestamp_prespec={0x44, 0x3c, 0x8c, 0x3, 0x5, [{@multicast1}, {@empty}, {@rand_addr=0x64010100, 0x10000}, {@broadcast, 0xff45}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xedf3}, {@remote}, {@multicast1, 0xa091}]}, @cipso={0x86, 0x2d, 0x2, [{0x6, 0x11, "177b8481bf6698a0da9fe15b2b13c6"}, {0x0, 0x6, "79740aaf"}, {0x5, 0x10, "ab29f7fdf132f291771a3591ab31"}]}, @ssrr={0x89, 0xb, 0x83, [@dev={0xac, 0x14, 0x14, 0x1a}, @multicast2]}, @timestamp_addr={0x44, 0x24, 0xc5, 0x1, 0xa, [{@dev={0xac, 0x14, 0x14, 0x1b}, 0x1}, {@remote, 0x3f}, {@multicast2, 0x4}, {@loopback, 0x6}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x2011}}) 00:11:21 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 19) 00:11:21 executing program 1: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040), 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) munlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}}) [ 2766.032055][ T683] Call Trace: [ 2766.032062][ T683] [ 2766.032072][ T683] dump_stack_lvl+0xcd/0x134 [ 2766.032120][ T683] should_fail.cold+0x5/0xa 00:11:21 executing program 2: bpf$MAP_CREATE(0x3, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) [ 2766.032159][ T683] _copy_from_user+0x2a/0x170 00:11:21 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 11) 00:11:21 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0xc8241, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd29}, 0x1c}}, 0x0) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r3, 0x400, 0x70bd2d, 0x25dfdbfd, {{}, {}, {0x20, 0x17, {0x2, 0xffffffff, @l2={'eth', 0x3a, 'veth0_to_batadv\x00'}}}}, ["", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008816}, 0x20000800) munlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) (async) mmap$dsp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000001, 0x1010, r0, 0x0) [ 2766.032199][ T683] __sys_bpf+0x335/0x5700 00:11:21 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 20) [ 2766.032221][ T683] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 2766.032248][ T683] ? bpf_perf_link_attach+0x520/0x520 00:11:21 executing program 1: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040), 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) munlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}}) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040), 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) (async) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) (async) munlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) (async) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}}) (async) 00:11:21 executing program 2: bpf$MAP_CREATE(0x4, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) [ 2766.032280][ T683] ? find_held_lock+0x2d/0x110 [ 2766.032320][ T683] ? __ct_user_exit+0xff/0x150 00:11:21 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 12) 00:11:21 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffb000/0x3000)=nil) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x100010, r0, 0x0) syz_io_uring_setup(0x3338, &(0x7f0000000000)={0x0, 0xa336, 0x10, 0x3, 0x276, 0x0, r0}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:21 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 21) [ 2766.032378][ T683] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2766.032420][ T683] __x64_sys_bpf+0x75/0xb0 [ 2766.032442][ T683] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2766.032480][ T683] do_syscall_64+0x35/0xb0 [ 2766.032508][ T683] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2766.032533][ T683] RIP: 0033:0x7fefa9089109 [ 2766.032552][ T683] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 00:11:22 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) 00:11:22 executing program 2: bpf$MAP_CREATE(0x5, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:22 executing program 1: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040), 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) munlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}}) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040), 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) (async) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) (async) munlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) (async) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x6, &(0x7f0000ffc000/0x1000)=nil) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}}) (async) 00:11:22 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 13) 00:11:22 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffb000/0x3000)=nil) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x100010, r0, 0x0) syz_io_uring_setup(0x3338, &(0x7f0000000000)={0x0, 0xa336, 0x10, 0x3, 0x276, 0x0, r0}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:22 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 22) 00:11:22 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0x1, 0x58, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r0, 0x0, 0x8}, 0xc) [ 2766.032574][ T683] RSP: 002b:00007fefaa107168 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2766.032598][ T683] RAX: ffffffffffffffda RBX: 00007fefa919bf60 RCX: 00007fefa9089109 [ 2766.032614][ T683] RDX: 0000000000000048 RSI: 0000000020000000 RDI: 0000000000000000 00:11:22 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 23) 00:11:22 executing program 2: bpf$MAP_CREATE(0x6, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:22 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffb000/0x3000)=nil) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x100010, r0, 0x0) (async) syz_io_uring_setup(0x3338, &(0x7f0000000000)={0x0, 0xa336, 0x10, 0x3, 0x276, 0x0, r0}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) [ 2766.032629][ T683] RBP: 00007fefaa1071d0 R08: 0000000000000000 R09: 0000000000000000 [ 2766.032643][ T683] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 00:11:22 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 14) [ 2766.032658][ T683] R13: 00007ffe15b3f65f R14: 00007fefaa107300 R15: 0000000000022000 [ 2766.032691][ T683] 00:11:22 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 24) [ 2766.273506][ T710] FAULT_INJECTION: forcing a failure. [ 2766.273506][ T710] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2766.273539][ T710] CPU: 1 PID: 710 Comm: syz-executor.4 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2766.273568][ T710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2766.273583][ T710] Call Trace: [ 2766.273589][ T710] [ 2766.273599][ T710] dump_stack_lvl+0xcd/0x134 [ 2766.273645][ T710] should_fail.cold+0x5/0xa [ 2766.273683][ T710] _copy_to_user+0x2a/0x140 [ 2766.273723][ T710] io_uring_setup.cold+0x161c/0x19b3 [ 2766.273765][ T710] ? io_cqring_overflow_flush+0x140/0x140 [ 2766.273817][ T710] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2766.273856][ T710] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2766.273901][ T710] do_syscall_64+0x35/0xb0 [ 2766.273928][ T710] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2766.273954][ T710] RIP: 0033:0x7fecff489109 [ 2766.273979][ T710] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 2766.274004][ T710] RSP: 002b:00007fed0058e0e8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 00:11:22 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) 00:11:22 executing program 2: bpf$MAP_CREATE(0x7, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:22 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0x1, 0x58, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r0, 0x0, 0x8}, 0xc) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x3) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0x1, 0x58}, 0x10) (async) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r0, 0x0, 0x8}, 0xc) (async) 00:11:22 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 15) 00:11:22 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x80000001, &(0x7f0000ffd000/0x2000)=nil, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x50000, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}) 00:11:22 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 25) 00:11:22 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 26) 00:11:22 executing program 2: bpf$MAP_CREATE(0x8, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) [ 2766.274029][ T710] RAX: ffffffffffffffda RBX: 00007fecff59bf60 RCX: 00007fecff489109 [ 2766.274046][ T710] RDX: 0000000020ffb000 RSI: 00000000200000c0 RDI: 00000000000043c6 [ 2766.274062][ T710] RBP: 00000000200000c0 R08: 0000000020000180 R09: 0000000020000180 [ 2766.274078][ T710] R10: 0000000020000140 R11: 0000000000000206 R12: 0000000020000180 00:11:22 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0x1, 0x58, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r0, 0x0, 0x8}, 0xc) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x3) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0x1, 0x58}, 0x10) (async) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000000c0)={r0, 0x0, 0x8}, 0xc) (async) 00:11:22 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x80000001, &(0x7f0000ffd000/0x2000)=nil, 0x0) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x50000, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}) 00:11:22 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 16) [ 2766.274094][ T710] R13: 0000000020ffb000 R14: 0000000020000140 R15: 0000000020ffc000 [ 2766.274126][ T710] [ 2766.410814][ T722] socket: no more sockets [ 2766.568732][ T743] socket: no more sockets 00:11:22 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/121, 0x79, 0x0, &(0x7f0000000080)=""/49, 0x31}, &(0x7f0000000100)=0x40) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000ffd000/0x3000)=nil) [ 2766.978938][ T806] FAULT_INJECTION: forcing a failure. [ 2766.978938][ T806] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2766.978968][ T806] CPU: 1 PID: 806 Comm: syz-executor.2 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2766.978992][ T806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2766.979005][ T806] Call Trace: [ 2766.979011][ T806] [ 2766.979019][ T806] dump_stack_lvl+0xcd/0x134 [ 2766.979062][ T806] should_fail.cold+0x5/0xa [ 2766.979099][ T806] _copy_to_user+0x2a/0x140 [ 2766.979139][ T806] simple_read_from_buffer+0xcc/0x160 [ 2766.979169][ T806] proc_fail_nth_read+0x187/0x220 [ 2766.979197][ T806] ? proc_exe_link+0x1d0/0x1d0 00:11:22 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 27) 00:11:22 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) (async) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) 00:11:22 executing program 2: bpf$MAP_CREATE(0x9, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:22 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x80000001, &(0x7f0000ffd000/0x2000)=nil, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x50000, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x80000001, &(0x7f0000ffd000/0x2000)=nil, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x50000, 0x0) (async) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) (async) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}) (async) 00:11:22 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 17) 00:11:22 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/121, 0x79, 0x0, &(0x7f0000000080)=""/49, 0x31}, &(0x7f0000000100)=0x40) (async) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000ffd000/0x3000)=nil) [ 2766.979221][ T806] ? security_file_permission+0xab/0xd0 00:11:22 executing program 2: bpf$MAP_CREATE(0xa, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) [ 2766.979255][ T806] ? proc_exe_link+0x1d0/0x1d0 00:11:22 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) mmap$qrtrtun(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x4000010, r0, 0x2) mmap$qrtrtun(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008, 0x50, 0xffffffffffffffff, 0xc492) 00:11:22 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/121, 0x79, 0x0, &(0x7f0000000080)=""/49, 0x31}, &(0x7f0000000100)=0x40) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000ffd000/0x3000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/121, 0x79, 0x0, &(0x7f0000000080)=""/49, 0x31}, &(0x7f0000000100)=0x40) (async) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000ffd000/0x3000)=nil) (async) 00:11:22 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 18) 00:11:22 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 28) [ 2766.979279][ T806] vfs_read+0x1ef/0x5d0 [ 2766.979305][ T806] ksys_read+0x127/0x250 [ 2766.979329][ T806] ? vfs_write+0xac0/0xac0 [ 2766.979352][ T806] ? syscall_enter_from_user_mode+0x22/0xb0 00:11:22 executing program 2: bpf$MAP_CREATE(0xb, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) [ 2766.979394][ T806] do_syscall_64+0x35/0xb0 [ 2766.979423][ T806] entry_SYSCALL_64_after_hwframe+0x46/0xb0 00:11:23 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) mmap$qrtrtun(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x4000010, r0, 0x2) mmap$qrtrtun(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008, 0x50, 0xffffffffffffffff, 0xc492) [ 2766.979449][ T806] RIP: 0033:0x7fefa903bcbc [ 2766.979469][ T806] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2766.979492][ T806] RSP: 002b:00007fefaa107160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2766.979514][ T806] RAX: ffffffffffffffda RBX: 00007fefa919bf60 RCX: 00007fefa903bcbc [ 2766.979531][ T806] RDX: 000000000000000f RSI: 00007fefaa1071e0 RDI: 0000000000000003 [ 2766.979546][ T806] RBP: 00007fefaa1071d0 R08: 0000000000000000 R09: 0000000000000000 [ 2766.979561][ T806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2766.979574][ T806] R13: 00007ffe15b3f65f R14: 00007fefaa107300 R15: 0000000000022000 [ 2766.979608][ T806] [ 2767.464367][ T862] FAULT_INJECTION: forcing a failure. 00:11:23 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$SNDCTL_DSP_GETISPACE(r0, 0x8010500d, &(0x7f0000000000)) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @multicast2}, @loopback, 0x13, 0x2011}}) 00:11:23 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc000, 0x7, &(0x7f0000ff4000/0xc000)=nil) 00:11:23 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 19) 00:11:23 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 29) 00:11:23 executing program 2: bpf$MAP_CREATE(0xc, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:23 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) mmap$qrtrtun(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x4000010, r0, 0x2) mmap$qrtrtun(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008, 0x50, 0xffffffffffffffff, 0xc492) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) (async) mmap$qrtrtun(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x4000010, r0, 0x2) (async) mmap$qrtrtun(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000008, 0x50, 0xffffffffffffffff, 0xc492) (async) [ 2767.464367][ T862] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2767.464400][ T862] CPU: 0 PID: 862 Comm: syz-executor.5 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 00:11:23 executing program 0: mremap(&(0x7f0000fec000/0x12000)=nil, 0x12000, 0x2000, 0x6, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ff1000/0x1000)=nil) 00:11:23 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc000, 0x7, &(0x7f0000ff4000/0xc000)=nil) 00:11:23 executing program 2: bpf$MAP_CREATE(0xd, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:23 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 20) [ 2767.464428][ T862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 00:11:23 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 30) [ 2767.464440][ T862] Call Trace: [ 2767.464446][ T862] [ 2767.464455][ T862] dump_stack_lvl+0xcd/0x134 [ 2767.464497][ T862] should_fail.cold+0x5/0xa 00:11:23 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc000, 0x7, &(0x7f0000ff4000/0xc000)=nil) [ 2767.464532][ T862] _copy_to_user+0x2a/0x140 [ 2767.464568][ T862] io_uring_setup.cold+0x161c/0x19b3 [ 2767.464608][ T862] ? io_cqring_overflow_flush+0x140/0x140 [ 2767.464656][ T862] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2767.464693][ T862] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2767.464738][ T862] do_syscall_64+0x35/0xb0 [ 2767.464767][ T862] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2767.464792][ T862] RIP: 0033:0x7fc8fc089109 [ 2767.464812][ T862] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 2767.464835][ T862] RSP: 002b:00007fc8fd2910e8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 2767.464866][ T862] RAX: ffffffffffffffda RBX: 00007fc8fc19bf60 RCX: 00007fc8fc089109 00:11:23 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$SNDCTL_DSP_GETISPACE(r0, 0x8010500d, &(0x7f0000000000)) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @multicast2}, @loopback, 0x13, 0x2011}}) 00:11:23 executing program 0: mremap(&(0x7f0000fec000/0x12000)=nil, 0x12000, 0x2000, 0x6, &(0x7f0000ffb000/0x2000)=nil) (async) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ff1000/0x1000)=nil) 00:11:23 executing program 2: bpf$MAP_CREATE(0xe, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:23 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 21) 00:11:23 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x1d0003, 0x0) 00:11:23 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 31) [ 2767.464883][ T862] RDX: 0000000020ffb000 RSI: 00000000200000c0 RDI: 00000000000043c6 [ 2767.464898][ T862] RBP: 00000000200000c0 R08: 0000000020000180 R09: 0000000020000180 [ 2767.464913][ T862] R10: 0000000020000140 R11: 0000000000000206 R12: 0000000020000180 [ 2767.464928][ T862] R13: 0000000020ffb000 R14: 0000000020000140 R15: 0000000020ffc000 00:11:23 executing program 2: bpf$MAP_CREATE(0xf, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:23 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x1d0003, 0x0) 00:11:23 executing program 0: mremap(&(0x7f0000fec000/0x12000)=nil, 0x12000, 0x2000, 0x6, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 32) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ff1000/0x1000)=nil) (rerun: 32) 00:11:23 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 22) [ 2767.464961][ T862] [ 2767.604605][ T887] socket: no more sockets [ 2767.752722][ T907] socket: no more sockets 00:11:23 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 32) 00:11:23 executing program 2: bpf$MAP_CREATE(0x10, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:23 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$SNDCTL_DSP_GETISPACE(r0, 0x8010500d, &(0x7f0000000000)) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @multicast2}, @loopback, 0x13, 0x2011}}) 00:11:23 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 23) 00:11:23 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x1d0003, 0x0) 00:11:23 executing program 2: bpf$MAP_CREATE(0x11, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:23 executing program 0: mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) mmap$usbfs(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000004, 0x60013, 0xffffffffffffffff, 0x1) 00:11:23 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 33) 00:11:23 executing program 0: mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) mmap$usbfs(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000004, 0x60013, 0xffffffffffffffff, 0x1) 00:11:23 executing program 2: bpf$MAP_CREATE(0x12, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:23 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 24) 00:11:23 executing program 1: ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)={0x20, 0x14, 0x9, 0x2, 0x59, 0xdbda, &(0x7f0000000000)="66f9ee697b507646aac8581bd3cb97b9ac8d7ba5cdeb5002a946bac089326650bff5cf2f9482b6b8f22c40b86450704216babd4595be0f6bd130c2b66dbcca68619a971a5df023bb0cf9dc9d8ad6ee1349c18fac5b058937ab"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x80802, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000240)=[{{0x0, 0x1, 0x1, 0x1}, {0x1, 0x1}}, {{0x3, 0x0, 0x0, 0x1}}, {{0x1, 0x1, 0x1}, {0x2, 0x0, 0x1, 0x1}}, {{0x2}, {0x2, 0x1, 0x0, 0x1}}, {{0x1, 0x1, 0x0, 0x1}, {0x4, 0x0, 0x1, 0x1}}, {{0x4, 0x1, 0x1, 0x1}, {0x2}}, {{0x4, 0x1, 0x1}, {0x3, 0x0, 0x0, 0x1}}, {{0x3, 0x1, 0x1}, {0x3, 0x1}}, {{0x4, 0x1}, {0x0, 0x1}}], 0x48) read$usbfs(r0, &(0x7f00000002c0)=""/51, 0x33) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x81) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) setsockopt$CAN_RAW_ERR_FILTER(r3, 0x65, 0x2, &(0x7f00000001c0)=0x9, 0x4) syz_io_uring_setup(0x7bf2, &(0x7f0000000100)={0x0, 0x1951, 0x20, 0x2, 0xfd, 0x0, r1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000200)) 00:11:23 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 34) 00:11:23 executing program 2: bpf$MAP_CREATE(0x13, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:24 executing program 3: setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000100)={0x18d, 0x0, 0x8001, 0x0, 0x7f}, 0x14) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x3, 0x2014}}) epoll_create1(0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000140)=[@mss={0x2, 0x8}, @mss={0x2, 0x5}, @timestamp, @timestamp], 0x4) getsockopt$inet_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), &(0x7f00000000c0)=0x4) 00:11:24 executing program 0: mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) (async) mmap$usbfs(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000004, 0x60013, 0xffffffffffffffff, 0x1) 00:11:24 executing program 1: ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)={0x20, 0x14, 0x9, 0x2, 0x59, 0xdbda, &(0x7f0000000000)="66f9ee697b507646aac8581bd3cb97b9ac8d7ba5cdeb5002a946bac089326650bff5cf2f9482b6b8f22c40b86450704216babd4595be0f6bd130c2b66dbcca68619a971a5df023bb0cf9dc9d8ad6ee1349c18fac5b058937ab"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x80802, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000240)=[{{0x0, 0x1, 0x1, 0x1}, {0x1, 0x1}}, {{0x3, 0x0, 0x0, 0x1}}, {{0x1, 0x1, 0x1}, {0x2, 0x0, 0x1, 0x1}}, {{0x2}, {0x2, 0x1, 0x0, 0x1}}, {{0x1, 0x1, 0x0, 0x1}, {0x4, 0x0, 0x1, 0x1}}, {{0x4, 0x1, 0x1, 0x1}, {0x2}}, {{0x4, 0x1, 0x1}, {0x3, 0x0, 0x0, 0x1}}, {{0x3, 0x1, 0x1}, {0x3, 0x1}}, {{0x4, 0x1}, {0x0, 0x1}}], 0x48) read$usbfs(r0, &(0x7f00000002c0)=""/51, 0x33) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x81) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) setsockopt$CAN_RAW_ERR_FILTER(r3, 0x65, 0x2, &(0x7f00000001c0)=0x9, 0x4) syz_io_uring_setup(0x7bf2, &(0x7f0000000100)={0x0, 0x1951, 0x20, 0x2, 0xfd, 0x0, r1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000200)) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)={0x20, 0x14, 0x9, 0x2, 0x59, 0xdbda, &(0x7f0000000000)="66f9ee697b507646aac8581bd3cb97b9ac8d7ba5cdeb5002a946bac089326650bff5cf2f9482b6b8f22c40b86450704216babd4595be0f6bd130c2b66dbcca68619a971a5df023bb0cf9dc9d8ad6ee1349c18fac5b058937ab"}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x80802, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) (async) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000240)=[{{0x0, 0x1, 0x1, 0x1}, {0x1, 0x1}}, {{0x3, 0x0, 0x0, 0x1}}, {{0x1, 0x1, 0x1}, {0x2, 0x0, 0x1, 0x1}}, {{0x2}, {0x2, 0x1, 0x0, 0x1}}, {{0x1, 0x1, 0x0, 0x1}, {0x4, 0x0, 0x1, 0x1}}, {{0x4, 0x1, 0x1, 0x1}, {0x2}}, {{0x4, 0x1, 0x1}, {0x3, 0x0, 0x0, 0x1}}, {{0x3, 0x1, 0x1}, {0x3, 0x1}}, {{0x4, 0x1}, {0x0, 0x1}}], 0x48) (async) read$usbfs(r0, &(0x7f00000002c0)=""/51, 0x33) (async) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x81) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) (async) setsockopt$CAN_RAW_ERR_FILTER(r3, 0x65, 0x2, &(0x7f00000001c0)=0x9, 0x4) (async) syz_io_uring_setup(0x7bf2, &(0x7f0000000100)={0x0, 0x1951, 0x20, 0x2, 0xfd, 0x0, r1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000200)) (async) 00:11:24 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 25) 00:11:24 executing program 2: bpf$MAP_CREATE(0x14, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:24 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 35) 00:11:24 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 26) 00:11:24 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 36) 00:11:24 executing program 1: ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)={0x20, 0x14, 0x9, 0x2, 0x59, 0xdbda, &(0x7f0000000000)="66f9ee697b507646aac8581bd3cb97b9ac8d7ba5cdeb5002a946bac089326650bff5cf2f9482b6b8f22c40b86450704216babd4595be0f6bd130c2b66dbcca68619a971a5df023bb0cf9dc9d8ad6ee1349c18fac5b058937ab"}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x80802, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) (async) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000240)=[{{0x0, 0x1, 0x1, 0x1}, {0x1, 0x1}}, {{0x3, 0x0, 0x0, 0x1}}, {{0x1, 0x1, 0x1}, {0x2, 0x0, 0x1, 0x1}}, {{0x2}, {0x2, 0x1, 0x0, 0x1}}, {{0x1, 0x1, 0x0, 0x1}, {0x4, 0x0, 0x1, 0x1}}, {{0x4, 0x1, 0x1, 0x1}, {0x2}}, {{0x4, 0x1, 0x1}, {0x3, 0x0, 0x0, 0x1}}, {{0x3, 0x1, 0x1}, {0x3, 0x1}}, {{0x4, 0x1}, {0x0, 0x1}}], 0x48) (async) read$usbfs(r0, &(0x7f00000002c0)=""/51, 0x33) (async) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x81) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) setsockopt$CAN_RAW_ERR_FILTER(r3, 0x65, 0x2, &(0x7f00000001c0)=0x9, 0x4) (async) syz_io_uring_setup(0x7bf2, &(0x7f0000000100)={0x0, 0x1951, 0x20, 0x2, 0xfd, 0x0, r1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000200)) 00:11:24 executing program 2: bpf$MAP_CREATE(0x15, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:24 executing program 0: get_mempolicy(&(0x7f00000000c0), &(0x7f0000000100), 0x7fffffff, &(0x7f0000ffd000/0x3000)=nil, 0x3) r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x180000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000200), r2) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="04002cbd7000fc3a1a64ce6bdbdf25010000000000000009410000004c02180000000062726f6164636173742d6c696e6b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d557724aedbba325b7af929c76b87780d64dbf39d92551d56dc0b1cff0683e6cf7c3f2150d34364229d4eec09d112a9570fd00a90680ce2ce99acf168cf8e56ac77d987e711a3ff74bde92a32064997f31b4b230c37514431c96b87c90b054961b765c269a0c8da9524c815a48136b3edbb386d6e0abacbc88818e4d8c97d70b318c41af47d4a726bb53293db4800d0c3c70edc2f17265ea3741ffa07280b60100ba7bc23da78ffb075663a5a6c94dc353e380e8e237011f4f1756f879b4f7e853120a1c38a9e6ac385839a66ca432bc7f56d41e58bacc5d0a119ad3f27a53cdf569a148a0821953007478a87b6c9266412c2948590f2300b453d4ce4cac0a1a8bdb632a69b5d13f7f4b72f50e7b70ed2d232af63f0e1becb9f4acef50b6c0d72491ebe59e026a8f684c68ee7417199c98015ed168354f2cbf6c7bfc51afb805f434b596d088abe290325d2988ad24fc1c4adbb3bda3755506fb28dda0ef2488a0fd463d7a9be51d"], 0x68}, 0x1, 0x0, 0x0, 0x20048801}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="000827bd7000ffffff7f240000000a0001007770616e3100000008000200", @ANYRES32=0x0, @ANYBLOB="08000200", @ANYRES32=r4, @ANYBLOB="08000200", @ANYRES32=0x0, @ANYBLOB="0a0001007770616e3300000008000200", @ANYRES32=r5, @ANYBLOB="3018cc65129c369b9c87b324ad5a1bff97c1040890fe0b653978226fa941eabae1d3bce0c812299a4aa34b7798a87f0e6052c4dd6872cf694a81f83a54d167aead93db298eefe6c7"], 0x4c}, 0x1, 0x0, 0x0, 0x4000014}, 0x40041) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x14}, 0x14}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r7, &(0x7f0000000740)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f0000000440)={0x14, r9, 0x200, 0x70bd2d, 0x25dfdbfd, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000801}, 0x40000) 00:11:24 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 27) 00:11:24 executing program 2: bpf$MAP_CREATE(0x16, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:24 executing program 3: setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000100)={0x18d, 0x0, 0x8001, 0x0, 0x7f}, 0x14) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x3, 0x2014}}) (async) epoll_create1(0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000140)=[@mss={0x2, 0x8}, @mss={0x2, 0x5}, @timestamp, @timestamp], 0x4) (async) getsockopt$inet_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), &(0x7f00000000c0)=0x4) 00:11:24 executing program 0: get_mempolicy(&(0x7f00000000c0), &(0x7f0000000100), 0x7fffffff, &(0x7f0000ffd000/0x3000)=nil, 0x3) r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 32) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x180000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000200), r2) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="04002cbd7000fc3a1a64ce6bdbdf25010000000000000009410000004c02180000000062726f6164636173742d6c696e6b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d557724aedbba325b7af929c76b87780d64dbf39d92551d56dc0b1cff0683e6cf7c3f2150d34364229d4eec09d112a9570fd00a90680ce2ce99acf168cf8e56ac77d987e711a3ff74bde92a32064997f31b4b230c37514431c96b87c90b054961b765c269a0c8da9524c815a48136b3edbb386d6e0abacbc88818e4d8c97d70b318c41af47d4a726bb53293db4800d0c3c70edc2f17265ea3741ffa07280b60100ba7bc23da78ffb075663a5a6c94dc353e380e8e237011f4f1756f879b4f7e853120a1c38a9e6ac385839a66ca432bc7f56d41e58bacc5d0a119ad3f27a53cdf569a148a0821953007478a87b6c9266412c2948590f2300b453d4ce4cac0a1a8bdb632a69b5d13f7f4b72f50e7b70ed2d232af63f0e1becb9f4acef50b6c0d72491ebe59e026a8f684c68ee7417199c98015ed168354f2cbf6c7bfc51afb805f434b596d088abe290325d2988ad24fc1c4adbb3bda3755506fb28dda0ef2488a0fd463d7a9be51d"], 0x68}, 0x1, 0x0, 0x0, 0x20048801}, 0x0) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="000827bd7000ffffff7f240000000a0001007770616e3100000008000200", @ANYRES32=0x0, @ANYBLOB="08000200", @ANYRES32=r4, @ANYBLOB="08000200", @ANYRES32=0x0, @ANYBLOB="0a0001007770616e3300000008000200", @ANYRES32=r5, @ANYBLOB="3018cc65129c369b9c87b324ad5a1bff97c1040890fe0b653978226fa941eabae1d3bce0c812299a4aa34b7798a87f0e6052c4dd6872cf694a81f83a54d167aead93db298eefe6c7"], 0x4c}, 0x1, 0x0, 0x0, 0x4000014}, 0x40041) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x14}, 0x14}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r7, &(0x7f0000000740)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f0000000440)={0x14, r9, 0x200, 0x70bd2d, 0x25dfdbfd, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000801}, 0x40000) 00:11:24 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 28) 00:11:24 executing program 1: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x3, 0x7f, 0x1, 0x401, 0xffff}, 0x14) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, @local, 0x13, 0x6}}) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:24 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 37) 00:11:24 executing program 2: bpf$MAP_CREATE(0x17, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:24 executing program 0: get_mempolicy(&(0x7f00000000c0), &(0x7f0000000100), 0x7fffffff, &(0x7f0000ffd000/0x3000)=nil, 0x3) r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x180000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x28}}, 0x0) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000200), r2) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', 0x0}) (rerun: 64) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="04002cbd7000fc3a1a64ce6bdbdf25010000000000000009410000004c02180000000062726f6164636173742d6c696e6b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d557724aedbba325b7af929c76b87780d64dbf39d92551d56dc0b1cff0683e6cf7c3f2150d34364229d4eec09d112a9570fd00a90680ce2ce99acf168cf8e56ac77d987e711a3ff74bde92a32064997f31b4b230c37514431c96b87c90b054961b765c269a0c8da9524c815a48136b3edbb386d6e0abacbc88818e4d8c97d70b318c41af47d4a726bb53293db4800d0c3c70edc2f17265ea3741ffa07280b60100ba7bc23da78ffb075663a5a6c94dc353e380e8e237011f4f1756f879b4f7e853120a1c38a9e6ac385839a66ca432bc7f56d41e58bacc5d0a119ad3f27a53cdf569a148a0821953007478a87b6c9266412c2948590f2300b453d4ce4cac0a1a8bdb632a69b5d13f7f4b72f50e7b70ed2d232af63f0e1becb9f4acef50b6c0d72491ebe59e026a8f684c68ee7417199c98015ed168354f2cbf6c7bfc51afb805f434b596d088abe290325d2988ad24fc1c4adbb3bda3755506fb28dda0ef2488a0fd463d7a9be51d"], 0x68}, 0x1, 0x0, 0x0, 0x20048801}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="000827bd7000ffffff7f240000000a0001007770616e3100000008000200", @ANYRES32=0x0, @ANYBLOB="08000200", @ANYRES32=r4, @ANYBLOB="08000200", @ANYRES32=0x0, @ANYBLOB="0a0001007770616e3300000008000200", @ANYRES32=r5, @ANYBLOB="3018cc65129c369b9c87b324ad5a1bff97c1040890fe0b653978226fa941eabae1d3bce0c812299a4aa34b7798a87f0e6052c4dd6872cf694a81f83a54d167aead93db298eefe6c7"], 0x4c}, 0x1, 0x0, 0x0, 0x4000014}, 0x40041) (async, rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (rerun: 64) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x14}, 0x14}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}}, 0x0) (async, rerun: 64) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r7, &(0x7f0000000740)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000700)={&(0x7f0000000440)={0x14, r9, 0x200, 0x70bd2d, 0x25dfdbfd, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000801}, 0x40000) (rerun: 64) 00:11:24 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 38) 00:11:24 executing program 1: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x3, 0x7f, 0x1, 0x401, 0xffff}, 0x14) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, @local, 0x13, 0x6}}) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$inet_mptcp(0x2, 0x1, 0x106) (async) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x3, 0x7f, 0x1, 0x401, 0xffff}, 0x14) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, @local, 0x13, 0x6}}) (async) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:24 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 29) 00:11:24 executing program 2: bpf$MAP_CREATE(0x18, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:24 executing program 3: setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000100)={0x18d, 0x0, 0x8001, 0x0, 0x7f}, 0x14) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x3, 0x2014}}) (async, rerun: 64) epoll_create1(0x0) (async, rerun: 64) socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000140)=[@mss={0x2, 0x8}, @mss={0x2, 0x5}, @timestamp, @timestamp], 0x4) getsockopt$inet_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), &(0x7f00000000c0)=0x4) 00:11:24 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 39) 00:11:24 executing program 1: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x3, 0x7f, 0x1, 0x401, 0xffff}, 0x14) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, @local, 0x13, 0x6}}) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:24 executing program 2: bpf$MAP_CREATE(0x19, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:24 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 40) 00:11:24 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 30) 00:11:24 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)={@private0, @loopback, 0x0, 0x5}}) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@multicast2, @loopback}) 00:11:25 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$inet6_udp(0xa, 0x2, 0x0) 00:11:25 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x131f, &(0x7f0000000000)={0x0, 0x274, 0x1, 0x0, 0x360}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:25 executing program 2: bpf$MAP_CREATE(0x1a, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:25 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 31) 00:11:25 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 41) 00:11:25 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)={@private0, @loopback, 0x0, 0x5}}) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@multicast2, @loopback}) 00:11:25 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 42) 00:11:25 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$inet6_udp(0xa, 0x2, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) 00:11:25 executing program 2: bpf$MAP_CREATE(0x1b, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:25 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 32) 00:11:25 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x131f, &(0x7f0000000000)={0x0, 0x274, 0x1, 0x0, 0x360}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:25 executing program 2: bpf$MAP_CREATE(0x1c, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:25 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$inet6_udp(0xa, 0x2, 0x0) 00:11:25 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 64) syz_io_uring_setup(0x131f, &(0x7f0000000000)={0x0, 0x274, 0x1, 0x0, 0x360}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (rerun: 64) 00:11:25 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 33) 00:11:25 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 43) 00:11:25 executing program 2: bpf$MAP_CREATE(0x1d, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:25 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)={@private0, @loopback, 0x0, 0x5}}) (async) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@multicast2, @loopback}) 00:11:25 executing program 2: bpf$MAP_CREATE(0x1e, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:25 executing program 0: ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000c00000/0x400000)=nil, 0x400000}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000040) 00:11:25 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 34) 00:11:25 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 44) 00:11:25 executing program 2: bpf$MAP_CREATE(0x21, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:25 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 35) 00:11:25 executing program 0: ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000c00000/0x400000)=nil, 0x400000}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000040) 00:11:25 executing program 1: ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000000)=0x200000000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:25 executing program 2: bpf$MAP_CREATE(0x22, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:25 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 45) 00:11:25 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000000)=0x7ff, 0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1={0xfc, 0x1, '\x00', 0x1}, @multicast1, 0x1d, 0xa}}) ioctl$SNDCTL_TMR_SOURCE(r1, 0xc0045406) 00:11:25 executing program 0: ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000c00000/0x400000)=nil, 0x400000}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000040) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000c00000/0x400000)=nil, 0x400000}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000040) (async) 00:11:25 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 36) 00:11:26 executing program 2: bpf$MAP_CREATE(0x23, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:26 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 46) 00:11:26 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 37) 00:11:26 executing program 0: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffd000/0x3000)=nil) 00:11:26 executing program 1: ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000000)=0x200000000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000000)=0x200000000) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:26 executing program 2: bpf$MAP_CREATE(0x300, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:26 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000000)=0x7ff, 0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1={0xfc, 0x1, '\x00', 0x1}, @multicast1, 0x1d, 0xa}}) ioctl$SNDCTL_TMR_SOURCE(r1, 0xc0045406) socket$inet_udp(0x2, 0x2, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000000)=0x7ff, 0x4) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1={0xfc, 0x1, '\x00', 0x1}, @multicast1, 0x1d, 0xa}}) (async) ioctl$SNDCTL_TMR_SOURCE(r1, 0xc0045406) (async) 00:11:26 executing program 0: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffd000/0x3000)=nil) 00:11:26 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 47) 00:11:26 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 38) 00:11:26 executing program 1: ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000000)=0x200000000) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:26 executing program 2: bpf$MAP_CREATE(0x461, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:26 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000000)=0x7ff, 0x4) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1={0xfc, 0x1, '\x00', 0x1}, @multicast1, 0x1d, 0xa}}) ioctl$SNDCTL_TMR_SOURCE(r1, 0xc0045406) socket$inet_udp(0x2, 0x2, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000000)=0x7ff, 0x4) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private1={0xfc, 0x1, '\x00', 0x1}, @multicast1, 0x1d, 0xa}}) (async) ioctl$SNDCTL_TMR_SOURCE(r1, 0xc0045406) (async) 00:11:26 executing program 0: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffd000/0x3000)=nil) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffd000/0x3000)=nil) (async) 00:11:26 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 39) 00:11:26 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 48) 00:11:26 executing program 2: bpf$MAP_CREATE(0x500, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:26 executing program 1: mremap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x300) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x4010, r0, 0x9) 00:11:26 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/235, 0xeb, 0x0, &(0x7f0000000100)=""/136, 0x88}, &(0x7f0000000200)=0x40) 00:11:26 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x60, 0x0, 0x604, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xf0}, @L2TP_ATTR_SEND_SEQ={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x3b}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x9}}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008008}, 0x3ff710acf2bdfc50) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:26 executing program 1: mremap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x300) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x4010, r0, 0x9) 00:11:26 executing program 2: bpf$MAP_CREATE(0x600, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:26 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/235, 0xeb, 0x0, &(0x7f0000000100)=""/136, 0x88}, &(0x7f0000000200)=0x40) 00:11:26 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 49) 00:11:26 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 40) 00:11:26 executing program 2: bpf$MAP_CREATE(0x700, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:26 executing program 1: mremap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x300) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x4010, r0, 0x9) 00:11:26 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/235, 0xeb, 0x0, &(0x7f0000000100)=""/136, 0x88}, &(0x7f0000000200)=0x40) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/235, 0xeb, 0x0, &(0x7f0000000100)=""/136, 0x88}, &(0x7f0000000200)=0x40) (async) 00:11:26 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 50) 00:11:26 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 41) 00:11:26 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4114, 0x1012, 0x1, &(0x7f0000001940)=""/189, 0xbd}, &(0x7f0000001100)=0x40) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000001140)=""/148, 0x94}, {&(0x7f0000001200)=""/216, 0xd8}, {&(0x7f0000001300)=""/229, 0xe5}, {&(0x7f0000001400)=""/208, 0xd0}, {&(0x7f0000001500)=""/150, 0x96}, {&(0x7f00000015c0)=""/170, 0xaa}, {&(0x7f0000001680)=""/221, 0xdd}], 0x7, &(0x7f0000001800)=""/4, 0x4}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) 00:11:26 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async, rerun: 64) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x60, 0x0, 0x604, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xf0}, @L2TP_ATTR_SEND_SEQ={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x3b}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x9}}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008008}, 0x3ff710acf2bdfc50) (async, rerun: 64) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:26 executing program 2: bpf$MAP_CREATE(0x900, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:26 executing program 0: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x8, &(0x7f0000ffa000/0x3000)=nil, 0x2) 00:11:26 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 51) 00:11:26 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4114, 0x1012, 0x1, &(0x7f0000001940)=""/189, 0xbd}, &(0x7f0000001100)=0x40) (async) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000001140)=""/148, 0x94}, {&(0x7f0000001200)=""/216, 0xd8}, {&(0x7f0000001300)=""/229, 0xe5}, {&(0x7f0000001400)=""/208, 0xd0}, {&(0x7f0000001500)=""/150, 0x96}, {&(0x7f00000015c0)=""/170, 0xaa}, {&(0x7f0000001680)=""/221, 0xdd}], 0x7, &(0x7f0000001800)=""/4, 0x4}, 0x10) (async) socket$inet6_tcp(0xa, 0x1, 0x0) 00:11:26 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 42) 00:11:26 executing program 0: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x8, &(0x7f0000ffa000/0x3000)=nil, 0x2) 00:11:26 executing program 2: bpf$MAP_CREATE(0xa00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:26 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 52) 00:11:26 executing program 0: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x8, &(0x7f0000ffa000/0x3000)=nil, 0x2) 00:11:26 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4114, 0x1012, 0x1, &(0x7f0000001940)=""/189, 0xbd}, &(0x7f0000001100)=0x40) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000001140)=""/148, 0x94}, {&(0x7f0000001200)=""/216, 0xd8}, {&(0x7f0000001300)=""/229, 0xe5}, {&(0x7f0000001400)=""/208, 0xd0}, {&(0x7f0000001500)=""/150, 0x96}, {&(0x7f00000015c0)=""/170, 0xaa}, {&(0x7f0000001680)=""/221, 0xdd}], 0x7, &(0x7f0000001800)=""/4, 0x4}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000010c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4114, 0x1012, 0x1, &(0x7f0000001940)=""/189, 0xbd}, &(0x7f0000001100)=0x40) (async) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000001140)=""/148, 0x94}, {&(0x7f0000001200)=""/216, 0xd8}, {&(0x7f0000001300)=""/229, 0xe5}, {&(0x7f0000001400)=""/208, 0xd0}, {&(0x7f0000001500)=""/150, 0x96}, {&(0x7f00000015c0)=""/170, 0xaa}, {&(0x7f0000001680)=""/221, 0xdd}], 0x7, &(0x7f0000001800)=""/4, 0x4}, 0x10) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) 00:11:26 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 43) 00:11:27 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x60, 0x0, 0x604, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xf0}, @L2TP_ATTR_SEND_SEQ={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xff}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x3b}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x9}}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4008008}, 0x3ff710acf2bdfc50) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:27 executing program 2: bpf$MAP_CREATE(0xb00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 0: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x3, 0xffffffffffffffff, 0x8, 0x80000}) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f00000000c0)=@urb_type_control={0x2, {}, 0xffff, 0x4, &(0x7f0000000040)={0x5, 0x14, 0x400, 0x1000, 0x8}, 0x8, 0x2, 0x1, 0x0, 0xffff8001, 0x9, &(0x7f0000000080)="ed18b0b719dfdaf04cdab8bdbff18872cc2529c303cf517a38ef1746ffeea73aa379a9ef919f9a4c15b901d8a9e8ddded37f61f49d356ac86a8f711a05c1"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$usbfs(&(0x7f0000000100), 0x5d, 0x20200) 00:11:27 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x7bcb9b913cd2b5d5, 0xffffffffffffffff, 0x0) 00:11:27 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 53) 00:11:27 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 44) 00:11:27 executing program 2: bpf$MAP_CREATE(0xc00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x7bcb9b913cd2b5d5, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x7bcb9b913cd2b5d5, 0xffffffffffffffff, 0x0) (async) 00:11:27 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 45) 00:11:27 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 54) 00:11:27 executing program 0: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x3, 0xffffffffffffffff, 0x8, 0x80000}) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f00000000c0)=@urb_type_control={0x2, {}, 0xffff, 0x4, &(0x7f0000000040)={0x5, 0x14, 0x400, 0x1000, 0x8}, 0x8, 0x2, 0x1, 0x0, 0xffff8001, 0x9, &(0x7f0000000080)="ed18b0b719dfdaf04cdab8bdbff18872cc2529c303cf517a38ef1746ffeea73aa379a9ef919f9a4c15b901d8a9e8ddded37f61f49d356ac86a8f711a05c1"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$usbfs(&(0x7f0000000100), 0x5d, 0x20200) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x3, 0xffffffffffffffff, 0x8, 0x80000}) (async) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f00000000c0)=@urb_type_control={0x2, {}, 0xffff, 0x4, &(0x7f0000000040)={0x5, 0x14, 0x400, 0x1000, 0x8}, 0x8, 0x2, 0x1, 0x0, 0xffff8001, 0x9, &(0x7f0000000080)="ed18b0b719dfdaf04cdab8bdbff18872cc2529c303cf517a38ef1746ffeea73aa379a9ef919f9a4c15b901d8a9e8ddded37f61f49d356ac86a8f711a05c1"}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_open_dev$usbfs(&(0x7f0000000100), 0x5d, 0x20200) (async) 00:11:27 executing program 2: bpf$MAP_CREATE(0xd00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 3: ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x38}, 0x3, 0x2011}}) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x4c, 0x18, {0x3f, @link='broadcast-link\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x4002}, 0x40000) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000340)={'sit0\x00', &(0x7f0000000300)={@ipv4={'\x00', '\xff\xff', @rand_addr=0x7}, @remote, 0x1c, 0x13}}) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xffffffffffffffe6, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb}}}, @L2TP_ATTR_LNS_MODE={0x0, 0x14, 0x7}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x94) ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000380)) 00:11:27 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x7bcb9b913cd2b5d5, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x7bcb9b913cd2b5d5, 0xffffffffffffffff, 0x0) (async) 00:11:27 executing program 0: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x3, 0xffffffffffffffff, 0x8, 0x80000}) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f00000000c0)=@urb_type_control={0x2, {}, 0xffff, 0x4, &(0x7f0000000040)={0x5, 0x14, 0x400, 0x1000, 0x8}, 0x8, 0x2, 0x1, 0x0, 0xffff8001, 0x9, &(0x7f0000000080)="ed18b0b719dfdaf04cdab8bdbff18872cc2529c303cf517a38ef1746ffeea73aa379a9ef919f9a4c15b901d8a9e8ddded37f61f49d356ac86a8f711a05c1"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$usbfs(&(0x7f0000000100), 0x5d, 0x20200) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x3, 0xffffffffffffffff, 0x8, 0x80000}) (async) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f00000000c0)=@urb_type_control={0x2, {}, 0xffff, 0x4, &(0x7f0000000040)={0x5, 0x14, 0x400, 0x1000, 0x8}, 0x8, 0x2, 0x1, 0x0, 0xffff8001, 0x9, &(0x7f0000000080)="ed18b0b719dfdaf04cdab8bdbff18872cc2529c303cf517a38ef1746ffeea73aa379a9ef919f9a4c15b901d8a9e8ddded37f61f49d356ac86a8f711a05c1"}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_open_dev$usbfs(&(0x7f0000000100), 0x5d, 0x20200) (async) 00:11:27 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 46) 00:11:27 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 55) 00:11:27 executing program 2: bpf$MAP_CREATE(0xe00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 2: bpf$MAP_CREATE(0xf00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 1: mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x6, &(0x7f0000fff000/0x1000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffc000/0x1000)=nil) ioctl$SNDCTL_SEQ_NRMIDIS(r0, 0x8004510b, &(0x7f0000000080)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) socketpair(0x2, 0x2, 0xffff, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000100)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) r6 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x202a00, 0x0) ioctl$SIOCGETSGCNT_IN6(r6, 0x89e1, &(0x7f0000000180)={@loopback, @private2}) getsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000040), &(0x7f0000000000)=0x4) 00:11:27 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 56) 00:11:27 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SNDCTL_SYNTH_INFO(r1, 0xc08c5102, &(0x7f0000000040)={"5728ce584501e762bde969d05afec832bc22e56b8035fbce72c6332d6fb0", 0x9d, 0x1, 0x401, 0x61, 0x57b, 0x1, 0xffffffdc, 0x5, [0x3, 0x1f, 0x4, 0xffffffff, 0x10001, 0x6, 0x0, 0x7fff, 0x80000001, 0x6, 0x0, 0x13a, 0x6e, 0x1ff, 0x3, 0x9, 0x6, 0xffff, 0x5]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:27 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 47) 00:11:27 executing program 3: ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x38}, 0x3, 0x2011}}) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x4c, 0x18, {0x3f, @link='broadcast-link\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x4002}, 0x40000) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000340)={'sit0\x00', &(0x7f0000000300)={@ipv4={'\x00', '\xff\xff', @rand_addr=0x7}, @remote, 0x1c, 0x13}}) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xffffffffffffffe6, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb}}}, @L2TP_ATTR_LNS_MODE={0x0, 0x14, 0x7}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x94) ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000380)) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x38}, 0x3, 0x2011}}) (async) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x4c, 0x18, {0x3f, @link='broadcast-link\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x4002}, 0x40000) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000340)={'sit0\x00', &(0x7f0000000300)={@ipv4={'\x00', '\xff\xff', @rand_addr=0x7}, @remote, 0x1c, 0x13}}) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xffffffffffffffe6, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb}}}, @L2TP_ATTR_LNS_MODE={0x0, 0x14, 0x7}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x94) (async) ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000380)) (async) 00:11:27 executing program 2: bpf$MAP_CREATE(0x1100, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 1: mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x6, &(0x7f0000fff000/0x1000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffc000/0x1000)=nil) ioctl$SNDCTL_SEQ_NRMIDIS(r0, 0x8004510b, &(0x7f0000000080)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) socketpair(0x2, 0x2, 0xffff, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000100)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) r6 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x202a00, 0x0) ioctl$SIOCGETSGCNT_IN6(r6, 0x89e1, &(0x7f0000000180)={@loopback, @private2}) getsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000040), &(0x7f0000000000)=0x4) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x6, &(0x7f0000fff000/0x1000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffc000/0x1000)=nil) (async) ioctl$SNDCTL_SEQ_NRMIDIS(r0, 0x8004510b, &(0x7f0000000080)) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) socketpair(0x2, 0x2, 0xffff, &(0x7f00000000c0)) (async) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000100)) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) socket$can_raw(0x1d, 0x3, 0x1) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x202a00, 0x0) (async) ioctl$SIOCGETSGCNT_IN6(r6, 0x89e1, &(0x7f0000000180)={@loopback, @private2}) (async) getsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000040), &(0x7f0000000000)=0x4) (async) 00:11:27 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 57) 00:11:27 executing program 2: bpf$MAP_CREATE(0x1200, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SNDCTL_SYNTH_INFO(r1, 0xc08c5102, &(0x7f0000000040)={"5728ce584501e762bde969d05afec832bc22e56b8035fbce72c6332d6fb0", 0x9d, 0x1, 0x401, 0x61, 0x57b, 0x1, 0xffffffdc, 0x5, [0x3, 0x1f, 0x4, 0xffffffff, 0x10001, 0x6, 0x0, 0x7fff, 0x80000001, 0x6, 0x0, 0x13a, 0x6e, 0x1ff, 0x3, 0x9, 0x6, 0xffff, 0x5]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:27 executing program 3: ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x38}, 0x3, 0x2011}}) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x4c, 0x18, {0x3f, @link='broadcast-link\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x4002}, 0x40000) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000340)={'sit0\x00', &(0x7f0000000300)={@ipv4={'\x00', '\xff\xff', @rand_addr=0x7}, @remote, 0x1c, 0x13}}) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xffffffffffffffe6, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, 0x0, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb}}}, @L2TP_ATTR_LNS_MODE={0x0, 0x14, 0x7}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x94) (async) ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000380)) 00:11:27 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 48) 00:11:27 executing program 2: bpf$MAP_CREATE(0x1300, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 1: mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x6, &(0x7f0000fff000/0x1000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffc000/0x1000)=nil) ioctl$SNDCTL_SEQ_NRMIDIS(r0, 0x8004510b, &(0x7f0000000080)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) socketpair(0x2, 0x2, 0xffff, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000100)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) r6 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x202a00, 0x0) ioctl$SIOCGETSGCNT_IN6(r6, 0x89e1, &(0x7f0000000180)={@loopback, @private2}) getsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000040), &(0x7f0000000000)=0x4) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000, 0x6, &(0x7f0000fff000/0x1000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffc000/0x1000)=nil) (async) ioctl$SNDCTL_SEQ_NRMIDIS(r0, 0x8004510b, &(0x7f0000000080)) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) socketpair(0x2, 0x2, 0xffff, &(0x7f00000000c0)) (async) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000100)) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) socket$can_raw(0x1d, 0x3, 0x1) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x202a00, 0x0) (async) ioctl$SIOCGETSGCNT_IN6(r6, 0x89e1, &(0x7f0000000180)={@loopback, @private2}) (async) getsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000040), &(0x7f0000000000)=0x4) (async) 00:11:27 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SNDCTL_SYNTH_INFO(r1, 0xc08c5102, &(0x7f0000000040)={"5728ce584501e762bde969d05afec832bc22e56b8035fbce72c6332d6fb0", 0x9d, 0x1, 0x401, 0x61, 0x57b, 0x1, 0xffffffdc, 0x5, [0x3, 0x1f, 0x4, 0xffffffff, 0x10001, 0x6, 0x0, 0x7fff, 0x80000001, 0x6, 0x0, 0x13a, 0x6e, 0x1ff, 0x3, 0x9, 0x6, 0xffff, 0x5]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:27 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:27 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 58) 00:11:27 executing program 2: bpf$MAP_CREATE(0x1400, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 49) 00:11:27 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x10010, r0, 0x0) 00:11:27 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 59) 00:11:27 executing program 0: ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) 00:11:27 executing program 2: bpf$MAP_CREATE(0x1500, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:27 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 50) 00:11:27 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 60) 00:11:27 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x10010, r0, 0x0) 00:11:27 executing program 0: ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) (async) 00:11:28 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1600, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 51) 00:11:28 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 61) 00:11:28 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x10010, r0, 0x0) 00:11:28 executing program 0: ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) (async) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1700, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 1: ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f00000000c0)={0x80000000, &(0x7f0000000000)=[{}, {0x80000000}], &(0x7f0000000040)}) ioctl$MEDIA_IOC_ENUM_ENTITIES(0xffffffffffffffff, 0xc1007c01, &(0x7f0000000100)={r0}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:28 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:28 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 62) 00:11:28 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 52) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1800, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:28 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:28 executing program 1: ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f00000000c0)={0x80000000, &(0x7f0000000000)=[{}, {0x80000000}], &(0x7f0000000040)}) ioctl$MEDIA_IOC_ENUM_ENTITIES(0xffffffffffffffff, 0xc1007c01, &(0x7f0000000100)={r0}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:28 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 53) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1900, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:28 executing program 1: ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f00000000c0)={0x80000000, &(0x7f0000000000)=[{}, {0x80000000}], &(0x7f0000000040)}) ioctl$MEDIA_IOC_ENUM_ENTITIES(0xffffffffffffffff, 0xc1007c01, &(0x7f0000000100)={r0}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f00000000c0)={0x80000000, &(0x7f0000000000), &(0x7f0000000040)}) (async) ioctl$MEDIA_IOC_ENUM_ENTITIES(0xffffffffffffffff, 0xc1007c01, &(0x7f0000000100)={r0}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1a00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:28 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:28 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 54) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1b00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000540)={'ip_vti0\x00', 0x0, 0x80, 0x10, 0x7, 0x7, {{0x25, 0x4, 0x0, 0x9, 0x94, 0x67, 0x0, 0x6e, 0x29, 0x0, @broadcast, @empty, {[@timestamp_prespec={0x44, 0x3c, 0xe, 0x3, 0x3, [{@remote, 0x9}, {@dev={0xac, 0x14, 0x14, 0x34}, 0x200}, {@remote, 0x3ff}, {@empty, 0x6}, {@local, 0x4b1}, {@dev={0xac, 0x14, 0x14, 0x24}, 0x6}, {@rand_addr=0x64010101, 0x10001}]}, @timestamp_addr={0x44, 0x14, 0x13, 0x1, 0xa, [{@rand_addr=0x64010100, 0x81}, {@rand_addr=0x64010101, 0x9}]}, @timestamp={0x44, 0xc, 0xa6, 0x0, 0x6, [0x3daf, 0xf]}, @ra={0x94, 0x4}, @end, @timestamp={0x44, 0x1c, 0xcb, 0x0, 0x5, [0x0, 0x1ff, 0x400, 0x9, 0x2, 0x63e]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@mcast2, @loopback, 0x0, 0x2011}}) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000280), 0x2, 0x1) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000380)={0x8, 0x2, "eaa7a357e9b24d02173a1c252046c17231b9fa1b1bd2377ae73b4b77b7678f3e8f6e8db7882852cba2b876be65c929c63859a013aca79ff9fa8ae8515451007cea771818cc88f557880f28c70b63fed6cdd178d397a689e8e589041e70357b77c72d2b13b240186bf581e757d30a14821a481dc267b3e6b5b9dafecdba9e0ff99ad14a6ae7018cb9ee062b8d8dabbf8df1c51f8727d60c30157f85e358cdcef446b5cd7544338b08c1df95691548b65105ce99948f1b2fd61138924f6d1b0dfbea57238483070089dd408909914f69fc1614cfb7c037ceab34b243888159b2de869cf5beccabf903543e2c593dfd9b5e67addf004b728733ea52ed14a449abe1"}) ioctl$SNDCTL_TMR_START(0xffffffffffffffff, 0x5402) r3 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xfffffffffffffff8, 0x84022) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f0000000500)={0x3, 0x1}) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f0000000240)=0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000200)=@urb_type_interrupt={0x1, {0xf}, 0x9, 0x21, &(0x7f0000000080)="6a5575132e8687318396fb83425a1d0f31a9281cf5b7b06274993c49e7341c1891167ce7890016e406ef80f793aa1a882d62c4ad8e58f772c905da8ae18fbecf7954f5ee2614a2db83ed47ee042e16034e90aa348a981d655f1167454e8802ef6e4038911584f1129fd20ae77977ac8d9043280b1740ecd3a03bba5560400625bb17f326029707936f14b3a68f56063b48e6fbd85bbf3fe8f004306177", 0x9d, 0x7, 0xffffffff, 0x0, 0x80000000, 0xfff, &(0x7f0000000140)="ded33ab6743303fb258755bc5ffca14779e8d28320fd74d1eabd6bf3e7124efb40f7a68bd9c7581b6b4f29b8dd76798aabc16d1d8b942088b9f790adef88d0956320f37e7af4af36ae58143bf6a7d338d8233f58f145c385687e4e39ad8d780458e53e0aee9d23486dedacc1496b369699ee63c58afdc1c23a361ca08611ba4280f2"}) r4 = syz_open_dev$usbfs(&(0x7f0000000300), 0x1, 0x808c0) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000640)={0x40, 0xe, 0x1, 0x2, 0xa, 0x40, &(0x7f0000000600)="8d38ace4126d6ba17717"}) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000340)=0x4136) 00:11:28 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xd000, 0x0, &(0x7f0000ff3000/0xd000)=nil) 00:11:28 executing program 1: ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x1d, 0x1d}}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:28 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1c00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 55) 00:11:28 executing program 1: ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x1d, 0x1d}}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:28 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xd000, 0x0, &(0x7f0000ff3000/0xd000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xd000, 0x0, &(0x7f0000ff3000/0xd000)=nil) (async) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1d00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 56) 00:11:28 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1e00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xd000, 0x0, &(0x7f0000ff3000/0xd000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xd000, 0x0, &(0x7f0000ff3000/0xd000)=nil) (async) 00:11:28 executing program 1: ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x1d, 0x1d}}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:28 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 57) 00:11:28 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:28 executing program 2: bpf$MAP_CREATE(0x1f00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000540)={'ip_vti0\x00', 0x0, 0x80, 0x10, 0x7, 0x7, {{0x25, 0x4, 0x0, 0x9, 0x94, 0x67, 0x0, 0x6e, 0x29, 0x0, @broadcast, @empty, {[@timestamp_prespec={0x44, 0x3c, 0xe, 0x3, 0x3, [{@remote, 0x9}, {@dev={0xac, 0x14, 0x14, 0x34}, 0x200}, {@remote, 0x3ff}, {@empty, 0x6}, {@local, 0x4b1}, {@dev={0xac, 0x14, 0x14, 0x24}, 0x6}, {@rand_addr=0x64010101, 0x10001}]}, @timestamp_addr={0x44, 0x14, 0x13, 0x1, 0xa, [{@rand_addr=0x64010100, 0x81}, {@rand_addr=0x64010101, 0x9}]}, @timestamp={0x44, 0xc, 0xa6, 0x0, 0x6, [0x3daf, 0xf]}, @ra={0x94, 0x4}, @end, @timestamp={0x44, 0x1c, 0xcb, 0x0, 0x5, [0x0, 0x1ff, 0x400, 0x9, 0x2, 0x63e]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@mcast2, @loopback, 0x0, 0x2011}}) (async) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000280), 0x2, 0x1) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000380)={0x8, 0x2, "eaa7a357e9b24d02173a1c252046c17231b9fa1b1bd2377ae73b4b77b7678f3e8f6e8db7882852cba2b876be65c929c63859a013aca79ff9fa8ae8515451007cea771818cc88f557880f28c70b63fed6cdd178d397a689e8e589041e70357b77c72d2b13b240186bf581e757d30a14821a481dc267b3e6b5b9dafecdba9e0ff99ad14a6ae7018cb9ee062b8d8dabbf8df1c51f8727d60c30157f85e358cdcef446b5cd7544338b08c1df95691548b65105ce99948f1b2fd61138924f6d1b0dfbea57238483070089dd408909914f69fc1614cfb7c037ceab34b243888159b2de869cf5beccabf903543e2c593dfd9b5e67addf004b728733ea52ed14a449abe1"}) ioctl$SNDCTL_TMR_START(0xffffffffffffffff, 0x5402) (async) r3 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xfffffffffffffff8, 0x84022) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f0000000500)={0x3, 0x1}) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async, rerun: 32) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f0000000240)=0x1) (rerun: 32) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000200)=@urb_type_interrupt={0x1, {0xf}, 0x9, 0x21, &(0x7f0000000080)="6a5575132e8687318396fb83425a1d0f31a9281cf5b7b06274993c49e7341c1891167ce7890016e406ef80f793aa1a882d62c4ad8e58f772c905da8ae18fbecf7954f5ee2614a2db83ed47ee042e16034e90aa348a981d655f1167454e8802ef6e4038911584f1129fd20ae77977ac8d9043280b1740ecd3a03bba5560400625bb17f326029707936f14b3a68f56063b48e6fbd85bbf3fe8f004306177", 0x9d, 0x7, 0xffffffff, 0x0, 0x80000000, 0xfff, &(0x7f0000000140)="ded33ab6743303fb258755bc5ffca14779e8d28320fd74d1eabd6bf3e7124efb40f7a68bd9c7581b6b4f29b8dd76798aabc16d1d8b942088b9f790adef88d0956320f37e7af4af36ae58143bf6a7d338d8233f58f145c385687e4e39ad8d780458e53e0aee9d23486dedacc1496b369699ee63c58afdc1c23a361ca08611ba4280f2"}) (async) r4 = syz_open_dev$usbfs(&(0x7f0000000300), 0x1, 0x808c0) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000640)={0x40, 0xe, 0x1, 0x2, 0xa, 0x40, &(0x7f0000000600)="8d38ace4126d6ba17717"}) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000340)=0x4136) 00:11:28 executing program 1: ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550c, &(0x7f0000000000)) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000180)=@urb_type_interrupt={0x1, {0x5, 0x1}, 0x1, 0xa2, &(0x7f0000000040)="28e6bdc54a0bed446f8ce2a14c254366b643fe8648afe1df93bae2231b032a99519535cabbcaf9beaae191ce2ee4a18f5fb9ed5098cac6742b079f67c49d55152cedab67e20234f44c0b2c2c8f5da0ab326af41d90b4374f03de9426ba4277263894615b31fb64d334b816d139fe6705ac4717b7a85e86e78505438e81d7ca28918345f7bdb0c97d8118936246a043d08838eda26d65d39d8940f019bc", 0x9d, 0x7, 0x2000, 0x0, 0x2, 0x7f, &(0x7f0000000100)="8abecc9d9003735a2981c1c2fb039701e61d8a07f81ad37bf2249e8365c530b53976d232190ff06f1dd2833b8b67b7bd747974a3390f4e0c1c434466fc9060a91e"}) r0 = syz_open_dev$usbfs(&(0x7f00000001c0), 0x2, 0xa200) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000200)=0xffffffff) [ 2774.466479][ T1227] ieee802154 phy0 wpan0: encryption failed: -22 00:11:28 executing program 0: openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket(0x26, 0x6, 0x4) 00:11:28 executing program 2: bpf$MAP_CREATE(0x2000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:28 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:29 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 58) 00:11:29 executing program 1: ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550c, &(0x7f0000000000)) (async) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000180)=@urb_type_interrupt={0x1, {0x5, 0x1}, 0x1, 0xa2, &(0x7f0000000040)="28e6bdc54a0bed446f8ce2a14c254366b643fe8648afe1df93bae2231b032a99519535cabbcaf9beaae191ce2ee4a18f5fb9ed5098cac6742b079f67c49d55152cedab67e20234f44c0b2c2c8f5da0ab326af41d90b4374f03de9426ba4277263894615b31fb64d334b816d139fe6705ac4717b7a85e86e78505438e81d7ca28918345f7bdb0c97d8118936246a043d08838eda26d65d39d8940f019bc", 0x9d, 0x7, 0x2000, 0x0, 0x2, 0x7f, &(0x7f0000000100)="8abecc9d9003735a2981c1c2fb039701e61d8a07f81ad37bf2249e8365c530b53976d232190ff06f1dd2833b8b67b7bd747974a3390f4e0c1c434466fc9060a91e"}) (async) r0 = syz_open_dev$usbfs(&(0x7f00000001c0), 0x2, 0xa200) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000200)=0xffffffff) 00:11:29 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000540)={'ip_vti0\x00', 0x0, 0x80, 0x10, 0x7, 0x7, {{0x25, 0x4, 0x0, 0x9, 0x94, 0x67, 0x0, 0x6e, 0x29, 0x0, @broadcast, @empty, {[@timestamp_prespec={0x44, 0x3c, 0xe, 0x3, 0x3, [{@remote, 0x9}, {@dev={0xac, 0x14, 0x14, 0x34}, 0x200}, {@remote, 0x3ff}, {@empty, 0x6}, {@local, 0x4b1}, {@dev={0xac, 0x14, 0x14, 0x24}, 0x6}, {@rand_addr=0x64010101, 0x10001}]}, @timestamp_addr={0x44, 0x14, 0x13, 0x1, 0xa, [{@rand_addr=0x64010100, 0x81}, {@rand_addr=0x64010101, 0x9}]}, @timestamp={0x44, 0xc, 0xa6, 0x0, 0x6, [0x3daf, 0xf]}, @ra={0x94, 0x4}, @end, @timestamp={0x44, 0x1c, 0xcb, 0x0, 0x5, [0x0, 0x1ff, 0x400, 0x9, 0x2, 0x63e]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@mcast2, @loopback, 0x0, 0x2011}}) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000280), 0x2, 0x1) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000380)={0x8, 0x2, "eaa7a357e9b24d02173a1c252046c17231b9fa1b1bd2377ae73b4b77b7678f3e8f6e8db7882852cba2b876be65c929c63859a013aca79ff9fa8ae8515451007cea771818cc88f557880f28c70b63fed6cdd178d397a689e8e589041e70357b77c72d2b13b240186bf581e757d30a14821a481dc267b3e6b5b9dafecdba9e0ff99ad14a6ae7018cb9ee062b8d8dabbf8df1c51f8727d60c30157f85e358cdcef446b5cd7544338b08c1df95691548b65105ce99948f1b2fd61138924f6d1b0dfbea57238483070089dd408909914f69fc1614cfb7c037ceab34b243888159b2de869cf5beccabf903543e2c593dfd9b5e67addf004b728733ea52ed14a449abe1"}) ioctl$SNDCTL_TMR_START(0xffffffffffffffff, 0x5402) r3 = syz_open_dev$usbfs(&(0x7f00000004c0), 0xfffffffffffffff8, 0x84022) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f0000000500)={0x3, 0x1}) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f0000000240)=0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000200)=@urb_type_interrupt={0x1, {0xf}, 0x9, 0x21, &(0x7f0000000080)="6a5575132e8687318396fb83425a1d0f31a9281cf5b7b06274993c49e7341c1891167ce7890016e406ef80f793aa1a882d62c4ad8e58f772c905da8ae18fbecf7954f5ee2614a2db83ed47ee042e16034e90aa348a981d655f1167454e8802ef6e4038911584f1129fd20ae77977ac8d9043280b1740ecd3a03bba5560400625bb17f326029707936f14b3a68f56063b48e6fbd85bbf3fe8f004306177", 0x9d, 0x7, 0xffffffff, 0x0, 0x80000000, 0xfff, &(0x7f0000000140)="ded33ab6743303fb258755bc5ffca14779e8d28320fd74d1eabd6bf3e7124efb40f7a68bd9c7581b6b4f29b8dd76798aabc16d1d8b942088b9f790adef88d0956320f37e7af4af36ae58143bf6a7d338d8233f58f145c385687e4e39ad8d780458e53e0aee9d23486dedacc1496b369699ee63c58afdc1c23a361ca08611ba4280f2"}) r4 = syz_open_dev$usbfs(&(0x7f0000000300), 0x1, 0x808c0) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000640)={0x40, 0xe, 0x1, 0x2, 0xa, 0x40, &(0x7f0000000600)="8d38ace4126d6ba17717"}) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000340)=0x4136) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000540)={'ip_vti0\x00', 0x0, 0x80, 0x10, 0x7, 0x7, {{0x25, 0x4, 0x0, 0x9, 0x94, 0x67, 0x0, 0x6e, 0x29, 0x0, @broadcast, @empty, {[@timestamp_prespec={0x44, 0x3c, 0xe, 0x3, 0x3, [{@remote, 0x9}, {@dev={0xac, 0x14, 0x14, 0x34}, 0x200}, {@remote, 0x3ff}, {@empty, 0x6}, {@local, 0x4b1}, {@dev={0xac, 0x14, 0x14, 0x24}, 0x6}, {@rand_addr=0x64010101, 0x10001}]}, @timestamp_addr={0x44, 0x14, 0x13, 0x1, 0xa, [{@rand_addr=0x64010100, 0x81}, {@rand_addr=0x64010101, 0x9}]}, @timestamp={0x44, 0xc, 0xa6, 0x0, 0x6, [0x3daf, 0xf]}, @ra={0x94, 0x4}, @end, @timestamp={0x44, 0x1c, 0xcb, 0x0, 0x5, [0x0, 0x1ff, 0x400, 0x9, 0x2, 0x63e]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@mcast2, @loopback, 0x0, 0x2011}}) (async) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000280), 0x2, 0x1) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000380)={0x8, 0x2, "eaa7a357e9b24d02173a1c252046c17231b9fa1b1bd2377ae73b4b77b7678f3e8f6e8db7882852cba2b876be65c929c63859a013aca79ff9fa8ae8515451007cea771818cc88f557880f28c70b63fed6cdd178d397a689e8e589041e70357b77c72d2b13b240186bf581e757d30a14821a481dc267b3e6b5b9dafecdba9e0ff99ad14a6ae7018cb9ee062b8d8dabbf8df1c51f8727d60c30157f85e358cdcef446b5cd7544338b08c1df95691548b65105ce99948f1b2fd61138924f6d1b0dfbea57238483070089dd408909914f69fc1614cfb7c037ceab34b243888159b2de869cf5beccabf903543e2c593dfd9b5e67addf004b728733ea52ed14a449abe1"}) (async) ioctl$SNDCTL_TMR_START(0xffffffffffffffff, 0x5402) (async) syz_open_dev$usbfs(&(0x7f00000004c0), 0xfffffffffffffff8, 0x84022) (async) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f0000000500)={0x3, 0x1}) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f0000000240)=0x1) (async) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000200)=@urb_type_interrupt={0x1, {0xf}, 0x9, 0x21, &(0x7f0000000080)="6a5575132e8687318396fb83425a1d0f31a9281cf5b7b06274993c49e7341c1891167ce7890016e406ef80f793aa1a882d62c4ad8e58f772c905da8ae18fbecf7954f5ee2614a2db83ed47ee042e16034e90aa348a981d655f1167454e8802ef6e4038911584f1129fd20ae77977ac8d9043280b1740ecd3a03bba5560400625bb17f326029707936f14b3a68f56063b48e6fbd85bbf3fe8f004306177", 0x9d, 0x7, 0xffffffff, 0x0, 0x80000000, 0xfff, &(0x7f0000000140)="ded33ab6743303fb258755bc5ffca14779e8d28320fd74d1eabd6bf3e7124efb40f7a68bd9c7581b6b4f29b8dd76798aabc16d1d8b942088b9f790adef88d0956320f37e7af4af36ae58143bf6a7d338d8233f58f145c385687e4e39ad8d780458e53e0aee9d23486dedacc1496b369699ee63c58afdc1c23a361ca08611ba4280f2"}) (async) syz_open_dev$usbfs(&(0x7f0000000300), 0x1, 0x808c0) (async) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000640)={0x40, 0xe, 0x1, 0x2, 0xa, 0x40, &(0x7f0000000600)="8d38ace4126d6ba17717"}) (async) ioctl$USBDEVFS_RELEASE_PORT(r4, 0x80045519, &(0x7f0000000340)=0x4136) (async) 00:11:29 executing program 0: openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket(0x26, 0x6, 0x4) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) socket(0x26, 0x6, 0x4) (async) 00:11:29 executing program 2: bpf$MAP_CREATE(0x2100, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:29 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 59) 00:11:29 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:29 executing program 1: ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550c, &(0x7f0000000000)) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000180)=@urb_type_interrupt={0x1, {0x5, 0x1}, 0x1, 0xa2, &(0x7f0000000040)="28e6bdc54a0bed446f8ce2a14c254366b643fe8648afe1df93bae2231b032a99519535cabbcaf9beaae191ce2ee4a18f5fb9ed5098cac6742b079f67c49d55152cedab67e20234f44c0b2c2c8f5da0ab326af41d90b4374f03de9426ba4277263894615b31fb64d334b816d139fe6705ac4717b7a85e86e78505438e81d7ca28918345f7bdb0c97d8118936246a043d08838eda26d65d39d8940f019bc", 0x9d, 0x7, 0x2000, 0x0, 0x2, 0x7f, &(0x7f0000000100)="8abecc9d9003735a2981c1c2fb039701e61d8a07f81ad37bf2249e8365c530b53976d232190ff06f1dd2833b8b67b7bd747974a3390f4e0c1c434466fc9060a91e"}) r0 = syz_open_dev$usbfs(&(0x7f00000001c0), 0x2, 0xa200) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000200)=0xffffffff) 00:11:29 executing program 0: openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) socket(0x26, 0x6, 0x4) 00:11:29 executing program 2: bpf$MAP_CREATE(0x2200, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:29 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:29 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 60) 00:11:29 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x80482, 0x0) read$sequencer(r1, &(0x7f0000000100)=""/49, 0x31) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x25d8fc5f3c7ec186, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f0000000140)=0x4800000) 00:11:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000)=@gcm_128={{0x304}, "bdcb8120018e5932", "22b00a8158cf7195d3e0882bd502be32", "2a8bcf8c", "9705a64f5c83689c"}, 0x28) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:29 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = io_uring_setup(0x4a6, &(0x7f0000000000)={0x0, 0x14bf, 0x0, 0x3, 0x236}) mlock2(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x2e3d, &(0x7f0000000280)={0x0, 0x301d, 0x0, 0x2, 0x110}, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000300), &(0x7f0000000340)) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_LINK_TIMEOUT={0xf, 0x1, 0x0, 0x0, 0x0, &(0x7f00000001c0)={r3, r4+60000000}, 0x1, 0x1, 0x1}, 0x3) syz_io_uring_setup(0x3e0e, &(0x7f0000000080)={0x0, 0x7779, 0x1, 0x0, 0x238, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) 00:11:29 executing program 2: bpf$MAP_CREATE(0x2300, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000)=@gcm_128={{0x304}, "bdcb8120018e5932", "22b00a8158cf7195d3e0882bd502be32", "2a8bcf8c", "9705a64f5c83689c"}, 0x28) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:29 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 61) 00:11:29 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x9}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:29 executing program 2: bpf$MAP_CREATE(0x3f00, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000)=@gcm_128={{0x304}, "bdcb8120018e5932", "22b00a8158cf7195d3e0882bd502be32", "2a8bcf8c", "9705a64f5c83689c"}, 0x28) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000)=@gcm_128={{0x304}, "bdcb8120018e5932", "22b00a8158cf7195d3e0882bd502be32", "2a8bcf8c", "9705a64f5c83689c"}, 0x28) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:29 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = io_uring_setup(0x4a6, &(0x7f0000000000)={0x0, 0x14bf, 0x0, 0x3, 0x236}) (async) mlock2(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async, rerun: 32) syz_io_uring_setup(0x2e3d, &(0x7f0000000280)={0x0, 0x301d, 0x0, 0x2, 0x110}, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000300), &(0x7f0000000340)) (async, rerun: 32) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_LINK_TIMEOUT={0xf, 0x1, 0x0, 0x0, 0x0, &(0x7f00000001c0)={r3, r4+60000000}, 0x1, 0x1, 0x1}, 0x3) (async) syz_io_uring_setup(0x3e0e, &(0x7f0000000080)={0x0, 0x7779, 0x1, 0x0, 0x238, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) 00:11:29 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (fail_nth: 62) 00:11:29 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xa}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) [ 2775.307349][ T1748] FAULT_INJECTION: forcing a failure. [ 2775.307349][ T1748] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2775.307383][ T1748] CPU: 1 PID: 1748 Comm: syz-executor.5 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2775.307411][ T1748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2775.307424][ T1748] Call Trace: [ 2775.307430][ T1748] [ 2775.307439][ T1748] dump_stack_lvl+0xcd/0x134 [ 2775.307484][ T1748] should_fail.cold+0x5/0xa [ 2775.307521][ T1748] _copy_from_user+0x2a/0x170 [ 2775.307560][ T1748] kstrtouint_from_user+0xa8/0x190 [ 2775.307586][ T1748] ? kstrtouint+0x120/0x120 00:11:29 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x80482, 0x0) (async) read$sequencer(r1, &(0x7f0000000100)=""/49, 0x31) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async, rerun: 32) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x25d8fc5f3c7ec186, 0x0) (rerun: 32) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f0000000140)=0x4800000) 00:11:29 executing program 2: bpf$MAP_CREATE(0x4000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:29 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x1ab180, 0x0) ioctl$SNDCTL_SEQ_PANIC(r0, 0x5111) ioctl$SNDCTL_MIDI_INFO(r0, 0xc074510c, &(0x7f00000000c0)={"4ccdaee4319929d65a99e498a1283b55816fb8e3c685d85dff8acd9fccd9", 0x7f, 0x400, 0x9, [0x5, 0x0, 0x7, 0x4, 0x6, 0x1, 0x7f, 0xb18, 0x4, 0x7f, 0x7f71, 0xffffffc1, 0x80000001, 0x1, 0x2, 0x1, 0x101, 0xff]}) ioctl$SNDCTL_SEQ_RESETSAMPLES(0xffffffffffffffff, 0x40045109, &(0x7f0000000040)) 00:11:29 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xc}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:29 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) [ 2775.307622][ T1748] ? lock_release+0x780/0x780 [ 2775.307649][ T1748] proc_fail_nth_write+0x79/0x220 [ 2775.307677][ T1748] ? proc_task_getattr+0x1f0/0x1f0 00:11:29 executing program 2: bpf$MAP_CREATE(0x6104, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) [ 2775.307711][ T1748] ? proc_task_getattr+0x1f0/0x1f0 00:11:30 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x1ab180, 0x0) ioctl$SNDCTL_SEQ_PANIC(r0, 0x5111) ioctl$SNDCTL_MIDI_INFO(r0, 0xc074510c, &(0x7f00000000c0)={"4ccdaee4319929d65a99e498a1283b55816fb8e3c685d85dff8acd9fccd9", 0x7f, 0x400, 0x9, [0x5, 0x0, 0x7, 0x4, 0x6, 0x1, 0x7f, 0xb18, 0x4, 0x7f, 0x7f71, 0xffffffc1, 0x80000001, 0x1, 0x2, 0x1, 0x101, 0xff]}) ioctl$SNDCTL_SEQ_RESETSAMPLES(0xffffffffffffffff, 0x40045109, &(0x7f0000000040)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x1ab180, 0x0) (async) ioctl$SNDCTL_SEQ_PANIC(r0, 0x5111) (async) ioctl$SNDCTL_MIDI_INFO(r0, 0xc074510c, &(0x7f00000000c0)={"4ccdaee4319929d65a99e498a1283b55816fb8e3c685d85dff8acd9fccd9", 0x7f, 0x400, 0x9, [0x5, 0x0, 0x7, 0x4, 0x6, 0x1, 0x7f, 0xb18, 0x4, 0x7f, 0x7f71, 0xffffffc1, 0x80000001, 0x1, 0x2, 0x1, 0x101, 0xff]}) (async) ioctl$SNDCTL_SEQ_RESETSAMPLES(0xffffffffffffffff, 0x40045109, &(0x7f0000000040)) (async) [ 2775.307737][ T1748] vfs_write+0x269/0xac0 00:11:30 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) [ 2775.307768][ T1748] ksys_write+0x127/0x250 00:11:30 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) [ 2775.307792][ T1748] ? __ia32_sys_read+0xb0/0xb0 [ 2775.307818][ T1748] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2775.307863][ T1748] do_syscall_64+0x35/0xb0 [ 2775.307891][ T1748] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2775.307917][ T1748] RIP: 0033:0x7fc8fc03bc1f 00:11:30 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 64) r0 = io_uring_setup(0x4a6, &(0x7f0000000000)={0x0, 0x14bf, 0x0, 0x3, 0x236}) (async, rerun: 64) mlock2(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x2e3d, &(0x7f0000000280)={0x0, 0x301d, 0x0, 0x2, 0x110}, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000300), &(0x7f0000000340)) (async) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_LINK_TIMEOUT={0xf, 0x1, 0x0, 0x0, 0x0, &(0x7f00000001c0)={r3, r4+60000000}, 0x1, 0x1, 0x1}, 0x3) (async) syz_io_uring_setup(0x3e0e, &(0x7f0000000080)={0x0, 0x7779, 0x1, 0x0, 0x238, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) 00:11:30 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x1ab180, 0x0) ioctl$SNDCTL_SEQ_PANIC(r0, 0x5111) (async) ioctl$SNDCTL_MIDI_INFO(r0, 0xc074510c, &(0x7f00000000c0)={"4ccdaee4319929d65a99e498a1283b55816fb8e3c685d85dff8acd9fccd9", 0x7f, 0x400, 0x9, [0x5, 0x0, 0x7, 0x4, 0x6, 0x1, 0x7f, 0xb18, 0x4, 0x7f, 0x7f71, 0xffffffc1, 0x80000001, 0x1, 0x2, 0x1, 0x101, 0xff]}) (async) ioctl$SNDCTL_SEQ_RESETSAMPLES(0xffffffffffffffff, 0x40045109, &(0x7f0000000040)) 00:11:30 executing program 2: bpf$MAP_CREATE(0x400000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) [ 2775.307938][ T1748] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 2775.307961][ T1748] RSP: 002b:00007fc8fd291160 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2775.307985][ T1748] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc8fc03bc1f [ 2775.308001][ T1748] RDX: 0000000000000001 RSI: 00007fc8fd2911e0 RDI: 0000000000000003 [ 2775.308016][ T1748] RBP: 00007fc8fd2911d0 R08: 0000000000000000 R09: 0000000010000000 [ 2775.308030][ T1748] R10: 0000000000008011 R11: 0000000000000293 R12: 0000000000000002 [ 2775.308043][ T1748] R13: 00007fff8492f6bf R14: 00007fc8fd291300 R15: 0000000000022000 [ 2775.308079][ T1748] 00:11:30 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x80482, 0x0) read$sequencer(r1, &(0x7f0000000100)=""/49, 0x31) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x25d8fc5f3c7ec186, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f0000000140)=0x4800000) socket$inet_udp(0x2, 0x2, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) (async) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x80482, 0x0) (async) read$sequencer(r1, &(0x7f0000000100)=""/49, 0x31) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x25d8fc5f3c7ec186, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f0000000140)=0x4800000) (async) 00:11:30 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x10}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:30 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:30 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil) 00:11:30 executing program 2: bpf$MAP_CREATE(0x80ffff, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:30 executing program 0: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6a1b, &(0x7f0000000040)={0x0, 0x1a, 0x2, 0x3, 0x1ce}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:30 executing program 2: bpf$MAP_CREATE(0x1000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:30 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil) 00:11:30 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 0: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 32) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (rerun: 32) syz_io_uring_setup(0x6a1b, &(0x7f0000000040)={0x0, 0x1a, 0x2, 0x3, 0x1ce}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:31 executing program 2: bpf$MAP_CREATE(0x2000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:31 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x204802, 0x0) read$sequencer(r2, &(0x7f00000000c0)=""/4096, 0x1000) ioctl$SNDCTL_SEQ_PANIC(r1, 0x5111) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x200e}}) 00:11:31 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x2, &(0x7f0000ffc000/0x1000)=nil) 00:11:31 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x18}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 0: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x200000, 0x0) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6a1b, &(0x7f0000000040)={0x0, 0x1a, 0x2, 0x3, 0x1ce}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:31 executing program 2: bpf$MAP_CREATE(0x3000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:31 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80085504, &(0x7f0000000000)={0x6, 0x10001}) mmap$qrtrtun(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x40010, r0, 0x7) 00:11:31 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:31 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1e}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80085504, &(0x7f0000000000)={0x6, 0x10001}) (async) mmap$qrtrtun(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x40010, r0, 0x7) 00:11:31 executing program 2: bpf$MAP_CREATE(0x4000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:31 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x204802, 0x0) read$sequencer(r2, &(0x7f00000000c0)=""/4096, 0x1000) (async) ioctl$SNDCTL_SEQ_PANIC(r1, 0x5111) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x200e}}) 00:11:31 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:31 executing program 2: bpf$MAP_CREATE(0x5000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:31 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80085504, &(0x7f0000000000)={0x6, 0x10001}) mmap$qrtrtun(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x40010, r0, 0x7) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80085504, &(0x7f0000000000)={0x6, 0x10001}) (async) mmap$qrtrtun(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x40010, r0, 0x7) (async) 00:11:31 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x24}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 2: bpf$MAP_CREATE(0x6000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:31 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) 00:11:31 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:31 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 2: bpf$MAP_CREATE(0x7000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:31 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x204802, 0x0) read$sequencer(r2, &(0x7f00000000c0)=""/4096, 0x1000) ioctl$SNDCTL_SEQ_PANIC(r1, 0x5111) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x200e}}) 00:11:31 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) 00:11:31 executing program 0: r0 = io_uring_setup(0x68a7, &(0x7f00000000c0)={0x0, 0xc560, 0x10, 0x0, 0x3b7}) syz_io_uring_setup(0x61b4, &(0x7f0000000140)={0x0, 0x6221, 0x20, 0x1, 0x3d8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) mmap$dsp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x20010, r1, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@echo=0x7f) 00:11:31 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x9}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 2: bpf$MAP_CREATE(0x8000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:31 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x30}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) 00:11:31 executing program 2: bpf$MAP_CREATE(0x9000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:31 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xa}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x36}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:31 executing program 0: r0 = io_uring_setup(0x68a7, &(0x7f00000000c0)={0x0, 0xc560, 0x10, 0x0, 0x3b7}) syz_io_uring_setup(0x61b4, &(0x7f0000000140)={0x0, 0x6221, 0x20, 0x1, 0x3d8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) (async, rerun: 64) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (rerun: 64) mmap$dsp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x20010, r1, 0x0) (async) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2}) (async) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@echo=0x7f) 00:11:31 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) prctl$PR_SET_MM(0x23, 0x2, &(0x7f0000ffd000/0x1000)=nil) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x2, 0x3, 0x40}) r1 = socket(0x22, 0xa, 0x6) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2, 0x2000) ioctl$USBDEVFS_REAPURB(r2, 0x4008550c, &(0x7f00000000c0)) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000040)=0x1, 0x4) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) syz_io_uring_setup(0x44e4, &(0x7f0000000300)={0x0, 0x4e47, 0x0, 0x1, 0x19a, 0x0, r3}, &(0x7f0000c6b000/0x2000)=nil, &(0x7f0000e94000/0x2000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0xa59, &(0x7f0000000200)={0x0, 0x6922, 0x8, 0x2, 0x210, 0x0, r0}, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000d3d000/0x2000)=nil, &(0x7f0000000280), &(0x7f00000002c0)) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000d62000/0x4000)=nil, 0x4000, 0x2000008, 0x30, r0, 0x0) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {}, {0x18, 0x17, {0x9, 0x200000, @udp='udp:syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x22000814}, 0x4008000) 00:11:32 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x14}, 0x14}}, 0x20000001) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x68, r2, 0x0, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x10000, @link='syz1\x00'}}}, ["", "", "", "", "", ""]}, 0x68}}, 0x2000d080) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r2, 0x20, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004052) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000225bd7000fedbdf250300000008000100030000000800020002000000080001000100000008000200020000000800010002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000040}, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) socketpair(0x2a, 0x80000, 0x4, &(0x7f0000000340)={0xffffffffffffffff}) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000380)=0x2, 0x4) 00:11:32 executing program 2: bpf$MAP_CREATE(0xa000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xc}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3c}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) prctl$PR_SET_MM(0x23, 0x2, &(0x7f0000ffd000/0x1000)=nil) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x2, 0x3, 0x40}) (async) r1 = socket(0x22, 0xa, 0x6) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2, 0x2000) ioctl$USBDEVFS_REAPURB(r2, 0x4008550c, &(0x7f00000000c0)) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000040)=0x1, 0x4) (async) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) (async) syz_io_uring_setup(0x44e4, &(0x7f0000000300)={0x0, 0x4e47, 0x0, 0x1, 0x19a, 0x0, r3}, &(0x7f0000c6b000/0x2000)=nil, &(0x7f0000e94000/0x2000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0xa59, &(0x7f0000000200)={0x0, 0x6922, 0x8, 0x2, 0x210, 0x0, r0}, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000d3d000/0x2000)=nil, &(0x7f0000000280), &(0x7f00000002c0)) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000d62000/0x4000)=nil, 0x4000, 0x2000008, 0x30, r0, 0x0) (async) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {}, {0x18, 0x17, {0x9, 0x200000, @udp='udp:syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x22000814}, 0x4008000) 00:11:32 executing program 0: r0 = io_uring_setup(0x68a7, &(0x7f00000000c0)={0x0, 0xc560, 0x10, 0x0, 0x3b7}) syz_io_uring_setup(0x61b4, &(0x7f0000000140)={0x0, 0x6221, 0x20, 0x1, 0x3d8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) mmap$dsp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x20010, r1, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@echo=0x7f) io_uring_setup(0x68a7, &(0x7f00000000c0)={0x0, 0xc560, 0x10, 0x0, 0x3b7}) (async) syz_io_uring_setup(0x61b4, &(0x7f0000000140)={0x0, 0x6221, 0x20, 0x1, 0x3d8, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) mmap$dsp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x20010, r1, 0x0) (async) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x2}) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) (async) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@echo=0x7f) (async) 00:11:32 executing program 2: bpf$MAP_CREATE(0xb000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) prctl$PR_SET_MM(0x23, 0x2, &(0x7f0000ffd000/0x1000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x2, 0x3, 0x40}) (async) r1 = socket(0x22, 0xa, 0x6) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x2, 0x2000) ioctl$USBDEVFS_REAPURB(r2, 0x4008550c, &(0x7f00000000c0)) (async) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000040)=0x1, 0x4) (async) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) syz_io_uring_setup(0x44e4, &(0x7f0000000300)={0x0, 0x4e47, 0x0, 0x1, 0x19a, 0x0, r3}, &(0x7f0000c6b000/0x2000)=nil, &(0x7f0000e94000/0x2000)=nil, &(0x7f00000003c0), &(0x7f0000000400)) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0xa59, &(0x7f0000000200)={0x0, 0x6922, 0x8, 0x2, 0x210, 0x0, r0}, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000d3d000/0x2000)=nil, &(0x7f0000000280), &(0x7f00000002c0)) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000d62000/0x4000)=nil, 0x4000, 0x2000008, 0x30, r0, 0x0) (async) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {}, {0x18, 0x17, {0x9, 0x200000, @udp='udp:syz0\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x22000814}, 0x4008000) 00:11:32 executing program 2: bpf$MAP_CREATE(0xc000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x210802, 0x0) ioctl$SNDCTL_SEQ_THRESHOLD(r1, 0x4004510d, &(0x7f0000000080)=0x7fff) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_MIDI_PRETIME(r0, 0xc0046d00, &(0x7f0000000000)=0x3) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x40a000, 0x0) ioctl$SNDCTL_TMR_SELECT(r2, 0x40045408) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:32 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x14}, 0x14}}, 0x20000001) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r0) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x68, r2, 0x0, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x10000, @link='syz1\x00'}}}, ["", "", "", "", "", ""]}, 0x68}}, 0x2000d080) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) (async) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r2, 0x20, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004052) (async) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000225bd7000fedbdf250300000008000100030000000800020002000000080001000100000008000200020000000800010002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000040}, 0x1) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) socketpair(0x2a, 0x80000, 0x4, &(0x7f0000000340)={0xffffffffffffffff}) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000380)=0x2, 0x4) 00:11:32 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x10}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x60}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) 00:11:32 executing program 2: bpf$MAP_CREATE(0xd000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x210802, 0x0) ioctl$SNDCTL_SEQ_THRESHOLD(r1, 0x4004510d, &(0x7f0000000080)=0x7fff) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_MIDI_PRETIME(r0, 0xc0046d00, &(0x7f0000000000)=0x3) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x40a000, 0x0) ioctl$SNDCTL_TMR_SELECT(r2, 0x40045408) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x210802, 0x0) (async) ioctl$SNDCTL_SEQ_THRESHOLD(r1, 0x4004510d, &(0x7f0000000080)=0x7fff) (async) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_MIDI_PRETIME(r0, 0xc0046d00, &(0x7f0000000000)=0x3) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x40a000, 0x0) (async) ioctl$SNDCTL_TMR_SELECT(r2, 0x40045408) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:32 executing program 2: bpf$MAP_CREATE(0xe000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) 00:11:32 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) (async, rerun: 32) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x210802, 0x0) (rerun: 32) ioctl$SNDCTL_SEQ_THRESHOLD(r1, 0x4004510d, &(0x7f0000000080)=0x7fff) (async, rerun: 64) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (rerun: 64) ioctl$SNDCTL_MIDI_PRETIME(r0, 0xc0046d00, &(0x7f0000000000)=0x3) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x40a000, 0x0) ioctl$SNDCTL_TMR_SELECT(r2, 0x40045408) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:32 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x121}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 2: bpf$MAP_CREATE(0xf000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x14}, 0x14}}, 0x20000001) (async) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r0) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x68, r2, 0x0, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x10000, @link='syz1\x00'}}}, ["", "", "", "", "", ""]}, 0x68}}, 0x2000d080) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async, rerun: 64) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) (async, rerun: 64) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r2, 0x20, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4004052) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000225bd7000fedbdf250300000008000100030000000800020002000000080001000100000008000200020000000800010002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000040}, 0x1) (async, rerun: 64) r4 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) socketpair(0x2a, 0x80000, 0x4, &(0x7f0000000340)={0xffffffffffffffff}) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000380)=0x2, 0x4) 00:11:32 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) 00:11:32 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x18}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x4) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000040)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window={0x3, 0x8000, 0x7fff}, @timestamp, @timestamp, @sack_perm, @timestamp, @window={0x3, 0x7fff, 0x3}, @mss={0x2, 0x800}, @timestamp], 0x8) mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000140)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000001c0)={r2, 0x2, r1, 0x6, 0x80000}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000200), 0x4) munlock(&(0x7f0000ff9000/0x3000)=nil, 0x3000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x44400) 00:11:32 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x300}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 1: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000640)={0x0, 0x7, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f00000003c0)=[{}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000580)=[{}, {}, {}], 0x1, 0x0, &(0x7f0000000600)=[{}]}) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000006c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:32 executing program 2: bpf$MAP_CREATE(0x10000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x4) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000040)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window={0x3, 0x8000, 0x7fff}, @timestamp, @timestamp, @sack_perm, @timestamp, @window={0x3, 0x7fff, 0x3}, @mss={0x2, 0x800}, @timestamp], 0x8) mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000140)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000001c0)={r2, 0x2, r1, 0x6, 0x80000}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000200), 0x4) munlock(&(0x7f0000ff9000/0x3000)=nil, 0x3000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x44400) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x4) (async) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000040)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window={0x3, 0x8000, 0x7fff}, @timestamp, @timestamp, @sack_perm, @timestamp, @window={0x3, 0x7fff, 0x3}, @mss={0x2, 0x800}, @timestamp], 0x8) (async) mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000140)) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000001c0)={r2, 0x2, r1, 0x6, 0x80000}) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000200), 0x4) (async) munlock(&(0x7f0000ff9000/0x3000)=nil, 0x3000) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x44400) (async) 00:11:32 executing program 1: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000640)={0x0, 0x7, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f00000003c0)=[{}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000580)=[{}, {}, {}], 0x1, 0x0, &(0x7f0000000600)=[{}]}) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000006c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000640)={0x0, 0x7, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f00000003c0)=[{}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000580)=[{}, {}, {}], 0x1, 0x0, &(0x7f0000000600)=[{}]}) (async) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004) (async) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000006c0)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:32 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1e}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 2: bpf$MAP_CREATE(0x11000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 3: ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=0x64010100, 0x0, 0x2011}}) r1 = socket(0x1, 0xa, 0xffff) setsockopt$inet_tcp_buf(r1, 0x6, 0x21, &(0x7f00000000c0)="8be1e74b41774a98cc809d82a5c69849ad656a66eb2490882ab281ba1325baa578a3f3ffe5f9ca39625c433a66bc67ec0c82104229f5e9170a1fbb4f1a9135cb6b41e274f128699675220eb6a2", 0x4d) 00:11:32 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x700}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 1: ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000640)={0x0, 0x7, 0x0, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}], 0x4, 0x0, &(0x7f00000003c0)=[{}, {}, {}, {}], 0x3, 0x0, &(0x7f0000000580)=[{}, {}, {}], 0x1, 0x0, &(0x7f0000000600)=[{}]}) (async) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004) (async) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000006c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:32 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x4) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000040)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window={0x3, 0x8000, 0x7fff}, @timestamp, @timestamp, @sack_perm, @timestamp, @window={0x3, 0x7fff, 0x3}, @mss={0x2, 0x800}, @timestamp], 0x8) mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000140)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000001c0)={r2, 0x2, r1, 0x6, 0x80000}) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000200), 0x4) munlock(&(0x7f0000ff9000/0x3000)=nil, 0x3000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x44400) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x4) (async) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000040)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window={0x3, 0x8000, 0x7fff}, @timestamp, @timestamp, @sack_perm, @timestamp, @window={0x3, 0x7fff, 0x3}, @mss={0x2, 0x800}, @timestamp], 0x8) (async) mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000140)) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000001c0)={r2, 0x2, r1, 0x6, 0x80000}) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000200), 0x4) (async) munlock(&(0x7f0000ff9000/0x3000)=nil, 0x3000) (async) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000000c0), 0x44400) (async) 00:11:32 executing program 2: bpf$MAP_CREATE(0x12000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x24}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_TMR_SELECT(r0, 0x40045408) 00:11:32 executing program 2: bpf$MAP_CREATE(0x13000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:32 executing program 0: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x7fff, 0x1, "b738ce8daa6db2a8113ce09043bab9dfcd870f8452652883d6bdf2e3ec6e2b422534217356d0af4f38bb76049f337a114cf4ed6ace56b2e3ffe5bc45bbaedddc1329d232dbece71a36e643ce038fe32ab647f80e37d5de4c3466448384a33196e138ae7dcaab9af7b38b9bb764ded42131c0451c8d58b1b9b7714aa5dba47632e5f5ca0a41be92fbd0a927c9223e2da37a3593c7196ffc2c4eb47634a7730671afd219d104feed7be38913f9ab2b921ac9ac07c510beb875a3480dd1ee6b8e0a339affeaae08fe4237851b3eac24f1593a2b7dcaa114f6d08bcaa7ec35c5cff4fde7588c25adfce178364b3cc393531b81851a9a2bcb5a12e688fc52e2cd2b1f"}) clock_gettime(0x6, &(0x7f0000000280)) ioctl$USBDEVFS_DISCARDURB(0xffffffffffffffff, 0x550b, &(0x7f0000000140)=0x3f) r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x9, 0x80) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f00000001c0)={0xb, 0x1}) syz_open_dev$usbfs(&(0x7f0000000200), 0x800, 0x40) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) r2 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) ioctl$USBDEVFS_DISCARDURB(r3, 0x550b, &(0x7f0000000300)=0x200017ffc) 00:11:32 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:32 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x900}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 2: bpf$MAP_CREATE(0x14000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 3: ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=0x64010100, 0x0, 0x2011}}) r1 = socket(0x1, 0xa, 0xffff) setsockopt$inet_tcp_buf(r1, 0x6, 0x21, &(0x7f00000000c0)="8be1e74b41774a98cc809d82a5c69849ad656a66eb2490882ab281ba1325baa578a3f3ffe5f9ca39625c433a66bc67ec0c82104229f5e9170a1fbb4f1a9135cb6b41e274f128699675220eb6a2", 0x4d) ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=0x64010100, 0x0, 0x2011}}) (async) socket(0x1, 0xa, 0xffff) (async) setsockopt$inet_tcp_buf(r1, 0x6, 0x21, &(0x7f00000000c0)="8be1e74b41774a98cc809d82a5c69849ad656a66eb2490882ab281ba1325baa578a3f3ffe5f9ca39625c433a66bc67ec0c82104229f5e9170a1fbb4f1a9135cb6b41e274f128699675220eb6a2", 0x4d) (async) 00:11:33 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_TMR_SELECT(r0, 0x40045408) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_TMR_SELECT(r0, 0x40045408) (async) 00:11:33 executing program 0: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x7fff, 0x1, "b738ce8daa6db2a8113ce09043bab9dfcd870f8452652883d6bdf2e3ec6e2b422534217356d0af4f38bb76049f337a114cf4ed6ace56b2e3ffe5bc45bbaedddc1329d232dbece71a36e643ce038fe32ab647f80e37d5de4c3466448384a33196e138ae7dcaab9af7b38b9bb764ded42131c0451c8d58b1b9b7714aa5dba47632e5f5ca0a41be92fbd0a927c9223e2da37a3593c7196ffc2c4eb47634a7730671afd219d104feed7be38913f9ab2b921ac9ac07c510beb875a3480dd1ee6b8e0a339affeaae08fe4237851b3eac24f1593a2b7dcaa114f6d08bcaa7ec35c5cff4fde7588c25adfce178364b3cc393531b81851a9a2bcb5a12e688fc52e2cd2b1f"}) (async) clock_gettime(0x6, &(0x7f0000000280)) (async) ioctl$USBDEVFS_DISCARDURB(0xffffffffffffffff, 0x550b, &(0x7f0000000140)=0x3f) (async) r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x9, 0x80) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f00000001c0)={0xb, 0x1}) syz_open_dev$usbfs(&(0x7f0000000200), 0x800, 0x40) (async) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) r2 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) (async) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) ioctl$USBDEVFS_DISCARDURB(r3, 0x550b, &(0x7f0000000300)=0x200017ffc) 00:11:33 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x30}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xa00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 2: bpf$MAP_CREATE(0x15000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 2: bpf$MAP_CREATE(0x16000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 0: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000000)={0x7fff, 0x1, "b738ce8daa6db2a8113ce09043bab9dfcd870f8452652883d6bdf2e3ec6e2b422534217356d0af4f38bb76049f337a114cf4ed6ace56b2e3ffe5bc45bbaedddc1329d232dbece71a36e643ce038fe32ab647f80e37d5de4c3466448384a33196e138ae7dcaab9af7b38b9bb764ded42131c0451c8d58b1b9b7714aa5dba47632e5f5ca0a41be92fbd0a927c9223e2da37a3593c7196ffc2c4eb47634a7730671afd219d104feed7be38913f9ab2b921ac9ac07c510beb875a3480dd1ee6b8e0a339affeaae08fe4237851b3eac24f1593a2b7dcaa114f6d08bcaa7ec35c5cff4fde7588c25adfce178364b3cc393531b81851a9a2bcb5a12e688fc52e2cd2b1f"}) (async) clock_gettime(0x6, &(0x7f0000000280)) (async) ioctl$USBDEVFS_DISCARDURB(0xffffffffffffffff, 0x550b, &(0x7f0000000140)=0x3f) r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x9, 0x80) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f00000001c0)={0xb, 0x1}) (async, rerun: 32) syz_open_dev$usbfs(&(0x7f0000000200), 0x800, 0x40) (async, rerun: 32) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) r2 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) (async) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) ioctl$USBDEVFS_DISCARDURB(r3, 0x550b, &(0x7f0000000300)=0x200017ffc) 00:11:33 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_TMR_SELECT(r0, 0x40045408) 00:11:33 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xc00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x36}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 1: mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000080), 0x41, &(0x7f0000ffc000/0x4000)=nil, 0x2) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x1002) 00:11:33 executing program 3: ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=0x64010100, 0x0, 0x2011}}) r1 = socket(0x1, 0xa, 0xffff) setsockopt$inet_tcp_buf(r1, 0x6, 0x21, &(0x7f00000000c0)="8be1e74b41774a98cc809d82a5c69849ad656a66eb2490882ab281ba1325baa578a3f3ffe5f9ca39625c433a66bc67ec0c82104229f5e9170a1fbb4f1a9135cb6b41e274f128699675220eb6a2", 0x4d) ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=0x64010100, 0x0, 0x2011}}) (async) socket(0x1, 0xa, 0xffff) (async) setsockopt$inet_tcp_buf(r1, 0x6, 0x21, &(0x7f00000000c0)="8be1e74b41774a98cc809d82a5c69849ad656a66eb2490882ab281ba1325baa578a3f3ffe5f9ca39625c433a66bc67ec0c82104229f5e9170a1fbb4f1a9135cb6b41e274f128699675220eb6a2", 0x4d) (async) 00:11:33 executing program 2: bpf$MAP_CREATE(0x17000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x200, 0x8001, &(0x7f0000000000)="bd6d507a51c641c9fc941cb9cf7d6c794f82947f13e083d9d8a42129"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:33 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3c}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 1: mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000080), 0x41, &(0x7f0000ffc000/0x4000)=nil, 0x2) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x1002) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000080), 0x41, &(0x7f0000ffc000/0x4000)=nil, 0x2) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x2, 0x0) (async) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x1002) (async) 00:11:33 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 2: bpf$MAP_CREATE(0x18000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x200, 0x8001, &(0x7f0000000000)="bd6d507a51c641c9fc941cb9cf7d6c794f82947f13e083d9d8a42129"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x200, 0x8001, &(0x7f0000000000)="bd6d507a51c641c9fc941cb9cf7d6c794f82947f13e083d9d8a42129"}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:33 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r2, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000000)={'syztnl1\x00', r4, 0x20, 0x8, 0x0, 0x0, {{0x7, 0x4, 0x1, 0x29, 0x1c, 0x68, 0x0, 0x1f, 0x29, 0x0, @rand_addr=0x64010100, @private=0xa010101, {[@end, @ra={0x94, 0x4, 0x1}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:33 executing program 2: bpf$MAP_CREATE(0x19000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3d}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 1: mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000080), 0x41, &(0x7f0000ffc000/0x4000)=nil, 0x2) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x1002) 00:11:33 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x200, 0x8001, &(0x7f0000000000)="bd6d507a51c641c9fc941cb9cf7d6c794f82947f13e083d9d8a42129"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x200, 0x8001, &(0x7f0000000000)="bd6d507a51c641c9fc941cb9cf7d6c794f82947f13e083d9d8a42129"}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:33 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 0: setsockopt$MRT_DONE(0xffffffffffffffff, 0x0, 0xc9, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) ioctl$SIOCGETSGCNT_IN6(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@private0, @loopback}) 00:11:33 executing program 1: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) 00:11:33 executing program 2: bpf$MAP_CREATE(0x1a000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 2: bpf$MAP_CREATE(0x1b000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) (async) r2 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r2, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000000)={'syztnl1\x00', r4, 0x20, 0x8, 0x0, 0x0, {{0x7, 0x4, 0x1, 0x29, 0x1c, 0x68, 0x0, 0x1f, 0x29, 0x0, @rand_addr=0x64010100, @private=0xa010101, {[@end, @ra={0x94, 0x4, 0x1}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:33 executing program 0: setsockopt$MRT_DONE(0xffffffffffffffff, 0x0, 0xc9, 0x0, 0x0) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) ioctl$SIOCGETSGCNT_IN6(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@private0, @loopback}) 00:11:33 executing program 1: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) (async) 00:11:33 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x60}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1e00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 2: bpf$MAP_CREATE(0x1c000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 0: setsockopt$MRT_DONE(0xffffffffffffffff, 0x0, 0xc9, 0x0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) ioctl$SIOCGETSGCNT_IN6(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@private0, @loopback}) setsockopt$MRT_DONE(0xffffffffffffffff, 0x0, 0xc9, 0x0, 0x0) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$SIOCGETSGCNT_IN6(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={@private0, @loopback}) (async) 00:11:33 executing program 1: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) 00:11:33 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 2: bpf$MAP_CREATE(0x1d000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:33 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:33 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:34 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:34 executing program 2: bpf$MAP_CREATE(0x1e000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:34 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) (async, rerun: 32) r2 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) (async, rerun: 32) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r2, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000000)={'syztnl1\x00', r4, 0x20, 0x8, 0x0, 0x0, {{0x7, 0x4, 0x1, 0x29, 0x1c, 0x68, 0x0, 0x1f, 0x29, 0x0, @rand_addr=0x64010100, @private=0xa010101, {[@end, @ra={0x94, 0x4, 0x1}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:34 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:34 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xda}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) 00:11:34 executing program 2: bpf$MAP_CREATE(0x1f000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:34 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2101}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:34 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x121}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:34 executing program 2: bpf$MAP_CREATE(0x20000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:34 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, @loopback, 0x1, 0x200f}}) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f0000000000)=0xffffffff) 00:11:34 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2400}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = userfaultfd(0x80001) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket(0x11, 0x3, 0x9) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f0000000000)=""/99, &(0x7f0000000080)=0x63) 00:11:34 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x300}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000140)=ANY=[@ANYBLOB="905d00000100000081c0f9cee46a892184b6c04711c296e1c1f40824ca4d2b075bee1a5aa8fd3012091926e4423d44d00b6f9e1308994b9c5f0ccee307a6a30efce60dcfa2a5434ba895a58efd962a663dd40d8896425b8d77f4d51175ea97f1f2b243fa4318040bf3618aa5f8baad"]) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x100000000, &(0x7f0000ffc000/0x3000)=nil, 0x3) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) 00:11:34 executing program 2: bpf$MAP_CREATE(0x21000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:34 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = userfaultfd(0x80001) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) (async) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r1 = socket(0x11, 0x3, 0x9) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f0000000000)=""/99, &(0x7f0000000080)=0x63) 00:11:34 executing program 2: bpf$MAP_CREATE(0x22000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:34 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000140)=ANY=[@ANYBLOB="905d00000100000081c0f9cee46a892184b6c04711c296e1c1f40824ca4d2b075bee1a5aa8fd3012091926e4423d44d00b6f9e1308994b9c5f0ccee307a6a30efce60dcfa2a5434ba895a58efd962a663dd40d8896425b8d77f4d51175ea97f1f2b243fa4318040bf3618aa5f8baad"]) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x100000000, &(0x7f0000ffc000/0x3000)=nil, 0x3) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000140)=ANY=[@ANYBLOB="905d00000100000081c0f9cee46a892184b6c04711c296e1c1f40824ca4d2b075bee1a5aa8fd3012091926e4423d44d00b6f9e1308994b9c5f0ccee307a6a30efce60dcfa2a5434ba895a58efd962a663dd40d8896425b8d77f4d51175ea97f1f2b243fa4318040bf3618aa5f8baad"]) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x100000000, &(0x7f0000ffc000/0x3000)=nil, 0x3) (async) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) (async) 00:11:34 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x324}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = userfaultfd(0x80001) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket(0x11, 0x3, 0x9) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f0000000000)=""/99, &(0x7f0000000080)=0x63) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) userfaultfd(0x80001) (async) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) socket(0x11, 0x3, 0x9) (async) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f0000000000)=""/99, &(0x7f0000000080)=0x63) (async) 00:11:34 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, @loopback, 0x1, 0x200f}}) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f0000000000)=0xffffffff) 00:11:34 executing program 2: bpf$MAP_CREATE(0x23000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:34 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000140)=ANY=[@ANYBLOB="905d00000100000081c0f9cee46a892184b6c04711c296e1c1f40824ca4d2b075bee1a5aa8fd3012091926e4423d44d00b6f9e1308994b9c5f0ccee307a6a30efce60dcfa2a5434ba895a58efd962a663dd40d8896425b8d77f4d51175ea97f1f2b243fa4318040bf3618aa5f8baad"]) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x100000000, &(0x7f0000ffc000/0x3000)=nil, 0x3) (async) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) 00:11:34 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) 00:11:34 executing program 2: bpf$MAP_CREATE(0x3f000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:34 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) 00:11:34 executing program 1: clock_gettime(0x0, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:34 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x339}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:34 executing program 2: bpf$MAP_CREATE(0x61040000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, @loopback, 0x1, 0x200f}}) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f0000000000)=0xffffffff) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, @loopback, 0x1, 0x200f}}) (async) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f0000000000)=0xffffffff) (async) 00:11:35 executing program 1: clock_gettime(0x0, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:35 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:35 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3c00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x399}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 2: bpf$MAP_CREATE(0xe4ffffff, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 1: clock_gettime(0x0, &(0x7f0000000000)) (async, rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (rerun: 64) 00:11:35 executing program 2: bpf$MAP_CREATE(0xffff8000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0xf2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x105, 0x70bd25, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x294}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4010040}, 0x4004000) openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x200040, 0x0) 00:11:35 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 1: openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x492880, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f00000001c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000100)={0xffffffffffffffff}, 0x3, {0xa, 0x4e21, 0xb0, @empty, 0xc0af}}}, 0x38) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f00000000c0), r0}}, 0x18) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4000, 0x4, &(0x7f0000ffb000/0x4000)=nil) r2 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) ioctl$USBDEVFS_DISCARDURB(r2, 0x550b, &(0x7f0000000200)=0x6) get_mempolicy(&(0x7f0000000040), &(0x7f0000000140), 0x4, &(0x7f0000ff9000/0x4000)=nil, 0x2) 00:11:35 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000000)=0x1, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:35 executing program 2: bpf$MAP_CREATE(0xffffffe4, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 2: bpf$MAP_CREATE(0x1000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0xf2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x105, 0x70bd25, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x294}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4010040}, 0x4004000) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x200040, 0x0) 00:11:35 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x700}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 1: openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x492880, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f00000001c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000100)={0xffffffffffffffff}, 0x3, {0xa, 0x4e21, 0xb0, @empty, 0xc0af}}}, 0x38) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f00000000c0), r0}}, 0x18) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4000, 0x4, &(0x7f0000ffb000/0x4000)=nil) r2 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) ioctl$USBDEVFS_DISCARDURB(r2, 0x550b, &(0x7f0000000200)=0x6) get_mempolicy(&(0x7f0000000040), &(0x7f0000000140), 0x4, &(0x7f0000ff9000/0x4000)=nil, 0x2) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x492880, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f00000001c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000100), 0x3, {0xa, 0x4e21, 0xb0, @empty, 0xc0af}}}, 0x38) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f00000000c0), r0}}, 0x18) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4000, 0x4, &(0x7f0000ffb000/0x4000)=nil) (async) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_DISCARDURB(r2, 0x550b, &(0x7f0000000200)=0x6) (async) get_mempolicy(&(0x7f0000000040), &(0x7f0000000140), 0x4, &(0x7f0000ff9000/0x4000)=nil, 0x2) (async) 00:11:35 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0xf2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x0, 0x105, 0x70bd25, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x294}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4010040}, 0x4004000) openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x200040, 0x0) 00:11:35 executing program 2: bpf$MAP_CREATE(0x40000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x900}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 1: openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x492880, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f00000001c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000100)={0xffffffffffffffff}, 0x3, {0xa, 0x4e21, 0xb0, @empty, 0xc0af}}}, 0x38) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f00000000c0), r0}}, 0x18) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4000, 0x4, &(0x7f0000ffb000/0x4000)=nil) (async) r2 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, 0x0) ioctl$USBDEVFS_DISCARDURB(r2, 0x550b, &(0x7f0000000200)=0x6) (async) get_mempolicy(&(0x7f0000000040), &(0x7f0000000140), 0x4, &(0x7f0000ff9000/0x4000)=nil, 0x2) 00:11:35 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async, rerun: 32) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000000)=0x1, 0x4) (rerun: 32) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:35 executing program 2: bpf$MAP_CREATE(0x80ffff00000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x40) mmap$qrtrtun(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r0, 0x1) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffc000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x2, &(0x7f0000ffc000/0x2000)=nil, 0x3) 00:11:35 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xa00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) ioctl$SNDCTL_MIDI_PRETIME(0xffffffffffffffff, 0xc0046d00, &(0x7f0000000000)=0x8001) 00:11:35 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x6000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x40) mmap$qrtrtun(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r0, 0x1) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffc000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x2, &(0x7f0000ffc000/0x2000)=nil, 0x3) 00:11:35 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) (async, rerun: 32) ioctl$SNDCTL_MIDI_PRETIME(0xffffffffffffffff, 0xc0046d00, &(0x7f0000000000)=0x8001) (rerun: 32) 00:11:35 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xc00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 2: bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x40) mmap$qrtrtun(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x200000c, 0x10, r0, 0x1) (async) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffc000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x2, &(0x7f0000ffc000/0x2000)=nil, 0x3) 00:11:35 executing program 2: bpf$MAP_CREATE(0x200000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000000)=0x1, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000000)=0x1, 0x4) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) 00:11:35 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) ioctl$SNDCTL_MIDI_PRETIME(0xffffffffffffffff, 0xc0046d00, &(0x7f0000000000)=0x8001) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) (async) ioctl$SNDCTL_MIDI_PRETIME(0xffffffffffffffff, 0xc0046d00, &(0x7f0000000000)=0x8001) (async) 00:11:35 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 0: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0x1, &(0x7f0000000000)="6eb0bf6af97a12bb287b9ccbdad973f6e9f4f74475974b7734dfeba27cac75e8e57ef8dd427f642957857ea12ce8685494b9216329707da6e49c1a", &(0x7f0000000040)=@buf="8295785d634976738df3871031274727290e0c7d9363cfdb6a614655498acf8bcacc37744cff6c9412e940296b538ac621b583c1122dd01f64954990b44b290740c78e024fc3ffc135f1bc295433499aee9b942f60283330390b2db2f2d97f705d24eb260abe9f2f72", 0x4}, 0x20) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x5}) r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000001c0)}, 0x10) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x39, 0x2, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x2e}, @broadcast}, 0x10) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ffb000/0x4000)=nil) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0x3, @vifc_lcl_addr=@multicast1, @dev={0xac, 0x14, 0x14, 0x3f}}, 0xd) 00:11:35 executing program 2: bpf$MAP_CREATE(0x300000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 0: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0x1, &(0x7f0000000000)="6eb0bf6af97a12bb287b9ccbdad973f6e9f4f74475974b7734dfeba27cac75e8e57ef8dd427f642957857ea12ce8685494b9216329707da6e49c1a", &(0x7f0000000040)=@buf="8295785d634976738df3871031274727290e0c7d9363cfdb6a614655498acf8bcacc37744cff6c9412e940296b538ac621b583c1122dd01f64954990b44b290740c78e024fc3ffc135f1bc295433499aee9b942f60283330390b2db2f2d97f705d24eb260abe9f2f72", 0x4}, 0x20) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 64) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) (async, rerun: 64) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x5}) (async) r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async, rerun: 32) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000001c0)}, 0x10) (async, rerun: 32) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x39, 0x2, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x2e}, @broadcast}, 0x10) (async) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ffb000/0x4000)=nil) (async) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0x3, @vifc_lcl_addr=@multicast1, @dev={0xac, 0x14, 0x14, 0x3f}}, 0xd) 00:11:35 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x400000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 2: bpf$MAP_CREATE(0x400000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:35 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:35 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_SEQ_NRSYNTHS(r0, 0x8004510a, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x4000, 0x0) write$sequencer(r1, &(0x7f00000000c0)=[@v={0x93, 0xe, 0xa0, 0x13, @MIDI_NOTEON=@special, 0x5}, @generic={0xc8}, @e={0xff, 0x9, 0x3, 0x20, @SEQ_NOTEON=@note=0x2, 0x30, 0xff, 0x7}, @raw={0xfe, 0x6, "6e64ffe92beb"}, @t={0x4, 0x6, 0x7f, 0x0, @generic=0xbb4a}, @x={0x94, 0x9, "d71993927cc7"}, @n={0x0, 0x80, @generic=0x2, 0x8}, @s={0x5, @generic=0x2, 0x9, 0x8}], 0x31) ioctl$SNDCTL_SEQ_CTRLRATE(0xffffffffffffffff, 0xc0045103, &(0x7f0000000040)=0x401) 00:11:36 executing program 2: bpf$MAP_CREATE(0x500000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x66, &(0x7f0000000000)=0x959, 0x4) 00:11:36 executing program 0: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0x1, &(0x7f0000000000)="6eb0bf6af97a12bb287b9ccbdad973f6e9f4f74475974b7734dfeba27cac75e8e57ef8dd427f642957857ea12ce8685494b9216329707da6e49c1a", &(0x7f0000000040)=@buf="8295785d634976738df3871031274727290e0c7d9363cfdb6a614655498acf8bcacc37744cff6c9412e940296b538ac621b583c1122dd01f64954990b44b290740c78e024fc3ffc135f1bc295433499aee9b942f60283330390b2db2f2d97f705d24eb260abe9f2f72", 0x4}, 0x20) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x5}) (async) r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000001c0)}, 0x10) (async) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x39, 0x2, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x2e}, @broadcast}, 0x10) (async) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ffb000/0x4000)=nil) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x0, 0x3, @vifc_lcl_addr=@multicast1, @dev={0xac, 0x14, 0x14, 0x3f}}, 0xd) 00:11:36 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x600000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_SEQ_NRSYNTHS(r0, 0x8004510a, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x4000, 0x0) write$sequencer(r1, &(0x7f00000000c0)=[@v={0x93, 0xe, 0xa0, 0x13, @MIDI_NOTEON=@special, 0x5}, @generic={0xc8}, @e={0xff, 0x9, 0x3, 0x20, @SEQ_NOTEON=@note=0x2, 0x30, 0xff, 0x7}, @raw={0xfe, 0x6, "6e64ffe92beb"}, @t={0x4, 0x6, 0x7f, 0x0, @generic=0xbb4a}, @x={0x94, 0x9, "d71993927cc7"}, @n={0x0, 0x80, @generic=0x2, 0x8}, @s={0x5, @generic=0x2, 0x9, 0x8}], 0x31) (async) ioctl$SNDCTL_SEQ_CTRLRATE(0xffffffffffffffff, 0xc0045103, &(0x7f0000000040)=0x401) 00:11:36 executing program 2: bpf$MAP_CREATE(0x600000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1e00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x80ffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 0: syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x1) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x7, 0x81) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000040)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) 00:11:36 executing program 2: bpf$MAP_CREATE(0x700000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_SEQ_NRSYNTHS(r0, 0x8004510a, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x4000, 0x0) write$sequencer(r1, &(0x7f00000000c0)=[@v={0x93, 0xe, 0xa0, 0x13, @MIDI_NOTEON=@special, 0x5}, @generic={0xc8}, @e={0xff, 0x9, 0x3, 0x20, @SEQ_NOTEON=@note=0x2, 0x30, 0xff, 0x7}, @raw={0xfe, 0x6, "6e64ffe92beb"}, @t={0x4, 0x6, 0x7f, 0x0, @generic=0xbb4a}, @x={0x94, 0x9, "d71993927cc7"}, @n={0x0, 0x80, @generic=0x2, 0x8}, @s={0x5, @generic=0x2, 0x9, 0x8}], 0x31) (async) ioctl$SNDCTL_SEQ_CTRLRATE(0xffffffffffffffff, 0xc0045103, &(0x7f0000000040)=0x401) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x66, &(0x7f0000000000)=0x959, 0x4) 00:11:36 executing program 0: syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x1) (async) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x7, 0x81) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000040)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) 00:11:36 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xb0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 2: bpf$MAP_CREATE(0x800000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 1: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x9, 0x2}, @window={0x3, 0x7, 0xfffc}, @mss={0x2, 0x8}, @window={0x3, 0x4, 0x3}, @window={0x3, 0xfffe, 0xffff}, @timestamp], 0x6) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:36 executing program 0: syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x1) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x7, 0x81) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000040)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x1) (async) syz_open_dev$usbfs(&(0x7f0000000080), 0x7, 0x81) (async) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000040)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xc0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 1: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x9, 0x2}, @window={0x3, 0x7, 0xfffc}, @mss={0x2, 0x8}, @window={0x3, 0x4, 0x3}, @window={0x3, 0xfffe, 0xffff}, @timestamp], 0x6) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x9, 0x2}, @window={0x3, 0x7, 0xfffc}, @mss={0x2, 0x8}, @window={0x3, 0x4, 0x3}, @window={0x3, 0xfffe, 0xffff}, @timestamp], 0x6) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:36 executing program 2: bpf$MAP_CREATE(0x900000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2101}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 1: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x9, 0x2}, @window={0x3, 0x7, 0xfffc}, @mss={0x2, 0x8}, @window={0x3, 0x4, 0x3}, @window={0x3, 0xfffe, 0xffff}, @timestamp], 0x6) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@window={0x3, 0x9, 0x2}, @window={0x3, 0x7, 0xfffc}, @mss={0x2, 0x8}, @window={0x3, 0x4, 0x3}, @window={0x3, 0xfffe, 0xffff}, @timestamp], 0x6) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:36 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) (async) setsockopt$inet_udp_int(r1, 0x11, 0x66, &(0x7f0000000000)=0x959, 0x4) 00:11:36 executing program 2: bpf$MAP_CREATE(0xa00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x1000)=nil, 0x2, 0x5, 0x1}) 00:11:36 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2400}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x6}) 00:11:36 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x1000)=nil, 0x2, 0x5, 0x1}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x1000)=nil, 0x2, 0x5, 0x1}) (async) 00:11:36 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 64) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x6}) (rerun: 64) 00:11:36 executing program 2: bpf$MAP_CREATE(0xb00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x6}) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2403}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) r2 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={'gre0\x00', r4, 0x8, 0x80, 0x9, 0x9, {{0x6, 0x4, 0x0, 0x6, 0x18, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @rand_addr=0x2, {[@end]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) 00:11:36 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x1000)=nil, 0x2, 0x5, 0x1}) 00:11:36 executing program 2: bpf$MAP_CREATE(0xc00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x1000)=nil, 0xa0, 0x4, 0x10}) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2603}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 2: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:36 executing program 0: socket$inet_mptcp(0x2, 0x1, 0x106) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x2, &(0x7f0000ffb000/0x3000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffb000/0x2000)=nil) 00:11:36 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x1000)=nil, 0xa0, 0x4, 0x10}) 00:11:36 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:36 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 2: bpf$MAP_CREATE(0xe00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:37 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x1000)=nil, 0xa0, 0x4, 0x10}) 00:11:37 executing program 0: socket$inet_mptcp(0x2, 0x1, 0x106) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x2, &(0x7f0000ffb000/0x3000)=nil) (async, rerun: 32) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffb000/0x2000)=nil) (rerun: 32) 00:11:37 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x6000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) r2 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={'gre0\x00', r4, 0x8, 0x80, 0x9, 0x9, {{0x6, 0x4, 0x0, 0x6, 0x18, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @rand_addr=0x2, {[@end]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) (async) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) (async) socket$igmp(0x2, 0x3, 0x2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x58, &(0x7f00000000c0)}, 0x10) (async) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={'gre0\x00', r4, 0x8, 0x80, 0x9, 0x9, {{0x6, 0x4, 0x0, 0x6, 0x18, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @rand_addr=0x2, {[@end]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) (async) 00:11:37 executing program 2: bpf$MAP_CREATE(0xf00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:37 executing program 0: socket$inet_mptcp(0x2, 0x1, 0x106) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x2, &(0x7f0000ffb000/0x3000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffb000/0x2000)=nil) socket$inet_mptcp(0x2, 0x1, 0x106) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x2, &(0x7f0000ffb000/0x3000)=nil) (async) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:37 executing program 2: bpf$MAP_CREATE(0x1000000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:37 executing program 1: syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x800) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x153200, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r1) sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfc, {}, [""]}, 0x1c}}, 0x40080c0) ioctl$SNDCTL_TMR_TIMEBASE(r1, 0xc0045401, &(0x7f00000000c0)=0x15e) ioctl$SNDCTL_TMR_TIMEBASE(r0, 0xc0045401, &(0x7f0000000040)=0xf5) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:37 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x7000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:37 executing program 2: bpf$MAP_CREATE(0x1100000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:37 executing program 1: syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) (async) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x800) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x153200, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r1) sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfc, {}, [""]}, 0x1c}}, 0x40080c0) (async, rerun: 64) ioctl$SNDCTL_TMR_TIMEBASE(r1, 0xc0045401, &(0x7f00000000c0)=0x15e) (rerun: 64) ioctl$SNDCTL_TMR_TIMEBASE(r0, 0xc0045401, &(0x7f0000000040)=0xf5) (async, rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (rerun: 64) 00:11:37 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x8000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3903}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) r2 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={'gre0\x00', r4, 0x8, 0x80, 0x9, 0x9, {{0x6, 0x4, 0x0, 0x6, 0x18, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @rand_addr=0x2, {[@end]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) (async) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) (async) socket$igmp(0x2, 0x3, 0x2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x58, &(0x7f00000000c0)}, 0x10) (async) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={'gre0\x00', r4, 0x8, 0x80, 0x9, 0x9, {{0x6, 0x4, 0x0, 0x6, 0x18, 0x65, 0x0, 0x1f, 0x4, 0x0, @multicast2, @rand_addr=0x2, {[@end]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) (async) 00:11:37 executing program 2: bpf$MAP_CREATE(0x1200000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:37 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:37 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3c00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x9000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 1: syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x800) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x153200, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r1) sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfc, {}, [""]}, 0x1c}}, 0x40080c0) ioctl$SNDCTL_TMR_TIMEBASE(r1, 0xc0045401, &(0x7f00000000c0)=0x15e) ioctl$SNDCTL_TMR_TIMEBASE(r0, 0xc0045401, &(0x7f0000000040)=0xf5) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x800) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x153200, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r1) (async) sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfc, {}, [""]}, 0x1c}}, 0x40080c0) (async) ioctl$SNDCTL_TMR_TIMEBASE(r1, 0xc0045401, &(0x7f00000000c0)=0x15e) (async) ioctl$SNDCTL_TMR_TIMEBASE(r0, 0xc0045401, &(0x7f0000000040)=0xf5) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:37 executing program 2: bpf$MAP_CREATE(0x1300000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:37 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r2 = socket$igmp(0x2, 0x3, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {}, {0x8}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x4000801) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000001c0)={0xffffffffffffffff, 0x2, 0x18}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r4, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r5, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000100)={'syztnl0\x00', r5, 0x8, 0x10, 0x8919, 0x9, {{0x10, 0x4, 0x1, 0xb, 0x40, 0x65, 0x0, 0x4c, 0x4, 0x0, @broadcast, @loopback, {[@ssrr={0x89, 0xb, 0x12, [@empty, @local]}, @generic={0x44, 0x3, "03"}, @lsrr={0x83, 0x1b, 0x51, [@dev={0xac, 0x14, 0x14, 0x14}, @loopback, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @rand_addr=0x64010101]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x17, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:37 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:37 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3d00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xa000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 1: mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) 00:11:37 executing program 2: bpf$MAP_CREATE(0x1400000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:37 executing program 1: mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:37 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x5) 00:11:37 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 2: bpf$MAP_CREATE(0x1500000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:37 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xc000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:37 executing program 1: mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 2: bpf$MAP_CREATE(0x1600000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:38 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x5) 00:11:38 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r2 = socket$igmp(0x2, 0x3, 0x2) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {}, {0x8}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x4000801) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000001c0)={0xffffffffffffffff, 0x2, 0x18}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r4, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r5, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000100)={'syztnl0\x00', r5, 0x8, 0x10, 0x8919, 0x9, {{0x10, 0x4, 0x1, 0xb, 0x40, 0x65, 0x0, 0x4c, 0x4, 0x0, @broadcast, @loopback, {[@ssrr={0x89, 0xb, 0x12, [@empty, @local]}, @generic={0x44, 0x3, "03"}, @lsrr={0x83, 0x1b, 0x51, [@dev={0xac, 0x14, 0x14, 0x14}, @loopback, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @rand_addr=0x64010101]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x17, 0x8}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:38 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2460a16}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x1f}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x4000) ioctl$SOUND_MIXER_READ_RECSRC(0xffffffffffffffff, 0x80044dff, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x5) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) (async) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x5) (async) 00:11:38 executing program 2: bpf$MAP_CREATE(0x1700000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:38 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2460a16}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x1f}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x4000) ioctl$SOUND_MIXER_READ_RECSRC(0xffffffffffffffff, 0x80044dff, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x10000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 2: bpf$MAP_CREATE(0x1800000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:38 executing program 0: r0 = semget$private(0x0, 0x4, 0x110) semctl$GETVAL(r0, 0x0, 0xc, 0x0) semctl$GETVAL(r0, 0x2, 0xc, &(0x7f0000000000)=""/133) socketpair(0x27, 0x4, 0x6, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0xffff, 0x10000, 0x7, 0x5}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40804}, 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x6000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2460a16}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x1f}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x4000) ioctl$SOUND_MIXER_READ_RECSRC(0xffffffffffffffff, 0x80044dff, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2460a16}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x1f}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r1}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x4000) (async) ioctl$SOUND_MIXER_READ_RECSRC(0xffffffffffffffff, 0x80044dff, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:38 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r2 = socket$igmp(0x2, 0x3, 0x2) (async, rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) (async) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {}, {0x8}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x4000801) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) (async) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000001c0)={0xffffffffffffffff, 0x2, 0x18}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r4, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r5, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000100)={'syztnl0\x00', r5, 0x8, 0x10, 0x8919, 0x9, {{0x10, 0x4, 0x1, 0xb, 0x40, 0x65, 0x0, 0x4c, 0x4, 0x0, @broadcast, @loopback, {[@ssrr={0x89, 0xb, 0x12, [@empty, @local]}, @generic={0x44, 0x3, "03"}, @lsrr={0x83, 0x1b, 0x51, [@dev={0xac, 0x14, 0x14, 0x14}, @loopback, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @rand_addr=0x64010101]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x17, 0x8}}) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (rerun: 64) 00:11:38 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x12000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 2: bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:38 executing program 0: r0 = semget$private(0x0, 0x4, 0x110) semctl$GETVAL(r0, 0x0, 0xc, 0x0) semctl$GETVAL(r0, 0x2, 0xc, &(0x7f0000000000)=""/133) socketpair(0x27, 0x4, 0x6, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0xffff, 0x10000, 0x7, 0x5}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40804}, 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) semget$private(0x0, 0x4, 0x110) (async) semctl$GETVAL(r0, 0x0, 0xc, 0x0) (async) semctl$GETVAL(r0, 0x2, 0xc, &(0x7f0000000000)=""/133) (async) socketpair(0x27, 0x4, 0x6, &(0x7f0000000200)) (async) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0xffff, 0x10000, 0x7, 0x5}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40804}, 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:38 executing program 1: r0 = getpgid(0x0) getpgid(r0) sched_rr_get_interval(r0, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x9903}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 2: bpf$MAP_CREATE(0x1a00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:38 executing program 1: r0 = getpgid(0x0) getpgid(r0) sched_rr_get_interval(r0, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) getpgid(0x0) (async) getpgid(r0) (async) sched_rr_get_interval(r0, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:38 executing program 0: r0 = semget$private(0x0, 0x4, 0x110) semctl$GETVAL(r0, 0x0, 0xc, 0x0) (async) semctl$GETVAL(r0, 0x2, 0xc, &(0x7f0000000000)=""/133) (async) socketpair(0x27, 0x4, 0x6, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x14, 0x19, {0xffff, 0x10000, 0x7, 0x5}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40804}, 0x4) (async, rerun: 32) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffb000/0x2000)=nil) (rerun: 32) 00:11:38 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x18000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 1: r0 = getpgid(0x0) getpgid(r0) (async, rerun: 64) sched_rr_get_interval(r0, &(0x7f0000000000)) (async, rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 00:11:38 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 2: bpf$MAP_CREATE(0x1b00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:38 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xda00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1e000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffd000/0x3000)=nil, 0x3) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1, 0x11, r0, 0xd7be) mlock2(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f0000000100)) 00:11:38 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 2: bpf$MAP_CREATE(0x1c00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:38 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:38 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffd000/0x3000)=nil, 0x3) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1, 0x11, r0, 0xd7be) mlock2(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f0000000100)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffd000/0x3000)=nil, 0x3) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x2, 0x0) (async) mmap$binder(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1, 0x11, r0, 0xd7be) (async) mlock2(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) (async) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f0000000100)) (async) 00:11:38 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async, rerun: 32) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (rerun: 32) 00:11:38 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x8c) 00:11:38 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x400000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:38 executing program 2: bpf$MAP_CREATE(0x1d00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:38 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffd000/0x3000)=nil, 0x3) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1, 0x11, r0, 0xd7be) (async) mlock2(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f0000000100)) 00:11:39 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x8c) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x8c) (async) 00:11:39 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x600000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:39 executing program 2: bpf$MAP_CREATE(0x1e00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:39 executing program 1: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000010, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r0, r2, &(0x7f00000000c0)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x9, 0x0, 0x0, 0x0, 0x1}, 0x164e) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000001000/0x3000)=nil) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000001c0), 0x400000, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x6}) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x640, 0x0) ioctl$UFFDIO_WAKE(r5, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000001000/0x4000)=nil, 0x4000}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, 0x0) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r6, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_SEQ_RESET(r6, 0x5100) ioctl$sock_inet_tcp_SIOCATMARK(r4, 0x8905, &(0x7f0000000000)) 00:11:39 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffafff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:39 executing program 2: bpf$MAP_CREATE(0x1f00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:39 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x10, 0x70bd29, 0x25dfdbfe, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) 00:11:39 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x80ffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:39 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x8c) 00:11:39 executing program 2: bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:39 executing program 1: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000010, 0x12, 0xffffffffffffffff, 0x0) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r0, r2, &(0x7f00000000c0)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x9, 0x0, 0x0, 0x0, 0x1}, 0x164e) (async, rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000001000/0x3000)=nil) (async, rerun: 64) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000001c0), 0x400000, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x6}) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async, rerun: 32) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x640, 0x0) (rerun: 32) ioctl$UFFDIO_WAKE(r5, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000001000/0x4000)=nil, 0x4000}) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, 0x0) (async) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r6, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_SEQ_RESET(r6, 0x5100) ioctl$sock_inet_tcp_SIOCATMARK(r4, 0x8905, &(0x7f0000000000)) 00:11:39 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffb000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:39 executing program 2: bpf$MAP_CREATE(0x2100000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:39 executing program 0: socketpair(0x2a, 0x1, 0xfffffffd, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x300, 0x70bd28, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x2dd2, @media='udp\x00'}}}, ["", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc00000, 0x0, &(0x7f0000400000/0xc00000)=nil) 00:11:39 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xb0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffbfff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 1: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000010, 0x12, 0xffffffffffffffff, 0x0) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r0, r2, &(0x7f00000000c0)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd_index=0x9, 0x0, 0x0, 0x0, 0x1}, 0x164e) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000001000/0x3000)=nil) (async) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f00000001c0), 0x400000, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x6}) (async) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x640, 0x0) ioctl$UFFDIO_WAKE(r5, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000001000/0x4000)=nil, 0x4000}) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, 0x0) (async) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r6, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_SEQ_RESET(r6, 0x5100) (async) ioctl$sock_inet_tcp_SIOCATMARK(r4, 0x8905, &(0x7f0000000000)) 00:11:40 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f00000000c0)="d08e61a0fc449e24998a7c019f5f9f4ea9c7468887cf925cf45a7e890038e57ca910b9ade776fd", &(0x7f0000000100)=@tcp=r1, 0x4}, 0x20) syz_open_dev$usbfs(&(0x7f0000000000), 0x6, 0x1000) 00:11:40 executing program 0: socketpair(0x2a, 0x1, 0xfffffffd, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x300, 0x70bd28, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x2dd2, @media='udp\x00'}}}, ["", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc00000, 0x0, &(0x7f0000400000/0xc00000)=nil) socketpair(0x2a, 0x1, 0xfffffffd, &(0x7f0000000000)) (async) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x300, 0x70bd28, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x2dd2, @media='udp\x00'}}}, ["", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc00000, 0x0, &(0x7f0000400000/0xc00000)=nil) (async) 00:11:40 executing program 2: bpf$MAP_CREATE(0x2200000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:40 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xc0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffc000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 2: bpf$MAP_CREATE(0x2300000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:40 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x1, 0x44200) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000000)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f0000000040)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:40 executing program 0: socketpair(0x2a, 0x1, 0xfffffffd, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x300, 0x70bd28, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x2dd2, @media='udp\x00'}}}, ["", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc00000, 0x0, &(0x7f0000400000/0xc00000)=nil) 00:11:40 executing program 2: bpf$MAP_CREATE(0x3f00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:40 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x8000, 0x8102) r1 = syz_open_dev$usbfs(&(0x7f0000000140), 0x3ab7, 0x88480) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f00000001c0)={0x8000001, &(0x7f0000000180)="e81861034dfa179685999572c8d2735e6f98a49a0ad780cf21dedd60c64cf489c3e6a9d8149c56170375da"}) ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f0000000100)={{{0x2, 0x1}}, 0x8f, 0x2, &(0x7f0000000040)="5fad82bba0613c08eaa3c8f40fec6f73e50dea873cc4958749c0496033b3d82667471529585d801d9574abe4bcfd2c3035058942123f1f3013eb592ffab8dd4e65743aa6f7753fe39ed7afd92c8bb1462f47b649d7cf3438591256069c5dc2eb70d952959a279f677e339d2d87c4dfe3423c4c79208c28987ad3cd1780f4dc4835a4cdba2e45f1ce7e51f2dac4b025"}) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000ffe000/0x2000)=nil) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200), 0x111880, 0x0) mmap$dsp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x12, r2, 0x0) 00:11:40 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x1, 0x44200) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000000)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f0000000040)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$usbfs(&(0x7f0000000080), 0x1, 0x44200) (async) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000000)) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f0000000040)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:40 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f00000000c0)="d08e61a0fc449e24998a7c019f5f9f4ea9c7468887cf925cf45a7e890038e57ca910b9ade776fd", &(0x7f0000000100)=@tcp=r1, 0x4}, 0x20) (async) syz_open_dev$usbfs(&(0x7f0000000000), 0x6, 0x1000) 00:11:40 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x21010000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 2: bpf$MAP_CREATE(0x6104000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:40 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x8000, 0x8102) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000140), 0x3ab7, 0x88480) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f00000001c0)={0x8000001, &(0x7f0000000180)="e81861034dfa179685999572c8d2735e6f98a49a0ad780cf21dedd60c64cf489c3e6a9d8149c56170375da"}) ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f0000000100)={{{0x2, 0x1}}, 0x8f, 0x2, &(0x7f0000000040)="5fad82bba0613c08eaa3c8f40fec6f73e50dea873cc4958749c0496033b3d82667471529585d801d9574abe4bcfd2c3035058942123f1f3013eb592ffab8dd4e65743aa6f7753fe39ed7afd92c8bb1462f47b649d7cf3438591256069c5dc2eb70d952959a279f677e339d2d87c4dfe3423c4c79208c28987ad3cd1780f4dc4835a4cdba2e45f1ce7e51f2dac4b025"}) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000ffe000/0x2000)=nil) (async) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200), 0x111880, 0x0) mmap$dsp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x12, r2, 0x0) 00:11:40 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x1, 0x44200) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000000)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f0000000040)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:40 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x24000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 2: bpf$MAP_CREATE(0xe4ffffff00000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:40 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x8000, 0x8102) (async) r1 = syz_open_dev$usbfs(&(0x7f0000000140), 0x3ab7, 0x88480) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f00000001c0)={0x8000001, &(0x7f0000000180)="e81861034dfa179685999572c8d2735e6f98a49a0ad780cf21dedd60c64cf489c3e6a9d8149c56170375da"}) (async) ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f0000000100)={{{0x2, 0x1}}, 0x8f, 0x2, &(0x7f0000000040)="5fad82bba0613c08eaa3c8f40fec6f73e50dea873cc4958749c0496033b3d82667471529585d801d9574abe4bcfd2c3035058942123f1f3013eb592ffab8dd4e65743aa6f7753fe39ed7afd92c8bb1462f47b649d7cf3438591256069c5dc2eb70d952959a279f677e339d2d87c4dfe3423c4c79208c28987ad3cd1780f4dc4835a4cdba2e45f1ce7e51f2dac4b025"}) (async, rerun: 32) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000ffe000/0x2000)=nil) (async, rerun: 32) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200), 0x111880, 0x0) mmap$dsp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x12, r2, 0x0) 00:11:40 executing program 1: mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1000, 0x4, &(0x7f0000ffb000/0x1000)=nil) r0 = syz_io_uring_setup(0xa08, &(0x7f0000000000)={0x0, 0x243d, 0x5, 0x5, 0x309}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000240)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r2, 0xc0286415, &(0x7f0000000180)={&(0x7f0000ffc000/0x4000)=nil, 0xd, 0x2, 0x18}) mmap$qrtrtun(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x5, 0x80010, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3498, &(0x7f0000000100)={0x0, 0x7a9a, 0x8, 0x1, 0x382}, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000001c0)=0x0) io_uring_setup(0x3e02, &(0x7f0000000280)={0x0, 0x426f, 0x10, 0x2, 0x80, 0x0, r0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000340), 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x400c040) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x2, 0x0, 0x7fff}, 0xffff) 00:11:40 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f00000000c0)="d08e61a0fc449e24998a7c019f5f9f4ea9c7468887cf925cf45a7e890038e57ca910b9ade776fd", &(0x7f0000000100)=@tcp=r1, 0x4}, 0x20) (async) syz_open_dev$usbfs(&(0x7f0000000000), 0x6, 0x1000) 00:11:40 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1e, 0x4, 0x4, 0x2}, 0x48) 00:11:40 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x800, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x1931, &(0x7f0000000000)={0x0, 0x97e4, 0x1, 0x3, 0x85}, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:40 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x30000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 1: mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1000, 0x4, &(0x7f0000ffb000/0x1000)=nil) r0 = syz_io_uring_setup(0xa08, &(0x7f0000000000)={0x0, 0x243d, 0x5, 0x5, 0x309}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000240)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) (async) ioctl$DRM_IOCTL_ADD_MAP(r2, 0xc0286415, &(0x7f0000000180)={&(0x7f0000ffc000/0x4000)=nil, 0xd, 0x2, 0x18}) (async) mmap$qrtrtun(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x5, 0x80010, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3498, &(0x7f0000000100)={0x0, 0x7a9a, 0x8, 0x1, 0x382}, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000001c0)=0x0) (async) io_uring_setup(0x3e02, &(0x7f0000000280)={0x0, 0x426f, 0x10, 0x2, 0x80, 0x0, r0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000340), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x400c040) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x2, 0x0, 0x7fff}, 0xffff) 00:11:40 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x800, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x1931, &(0x7f0000000000)={0x0, 0x97e4, 0x1, 0x3, 0x85}, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:40 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x36000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x8}, 0x48) 00:11:40 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x800, 0x0) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_io_uring_setup(0x1931, &(0x7f0000000000)={0x0, 0x97e4, 0x1, 0x3, 0x85}, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:40 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x6000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:40 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3c000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:41 executing program 1: mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1000, 0x4, &(0x7f0000ffb000/0x1000)=nil) (async) r0 = syz_io_uring_setup(0xa08, &(0x7f0000000000)={0x0, 0x243d, 0x5, 0x5, 0x309}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000240)) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r2, 0xc0286415, &(0x7f0000000180)={&(0x7f0000ffc000/0x4000)=nil, 0xd, 0x2, 0x18}) (async) mmap$qrtrtun(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x5, 0x80010, 0xffffffffffffffff, 0x0) (async) syz_io_uring_setup(0x3498, &(0x7f0000000100)={0x0, 0x7a9a, 0x8, 0x1, 0x382}, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000001c0)=0x0) (async) io_uring_setup(0x3e02, &(0x7f0000000280)={0x0, 0x426f, 0x10, 0x2, 0x80, 0x0, r0}) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000340), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x400c040) (async) syz_io_uring_submit(r1, r3, &(0x7f0000000200)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x2, 0x0, 0x7fff}, 0xffff) 00:11:41 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x240000c1}, 0x40000) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:41 executing program 0: socket$inet6_udplite(0xa, 0x2, 0x88) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffc000/0x1000)=nil, 0x0) 00:11:41 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x7000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 0: socket$inet6_udplite(0xa, 0x2, 0x88) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffc000/0x1000)=nil, 0x0) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x2}, 0x48) 00:11:41 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x8000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x40000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000002000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/4096, 0x1000}, &(0x7f0000002040)=0x40) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x3}, 0x48) 00:11:41 executing program 0: socket$inet6_udplite(0xa, 0x2, 0x88) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffc000/0x1000)=nil, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffc000/0x1000)=nil, 0x0) (async) 00:11:41 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x42000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x240000c1}, 0x40000) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x240000c1}, 0x40000) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) 00:11:41 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x9000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000002000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/4096, 0x1000}, &(0x7f0000002040)=0x40) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000002000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/4096, 0x1000}, &(0x7f0000002040)=0x40) (async) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x4}, 0x48) 00:11:41 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040), &(0x7f0000000080)=0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000280)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX=r0, @ANYBLOB="0008004000000fff000000094e1b003800640000132b907800000000ac1414a08917afac1414aa7f000001ac141443ac1414bbe0100002860a0000000107040cf3000000"]}) r1 = getpgid(0x0) getpgid(r1) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x3a, 0x0, 0x8}) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000200), &(0x7f0000000240)=0x14) 00:11:41 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4b000fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000002000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/4096, 0x1000, 0x0, &(0x7f0000001000)=""/4096, 0x1000}, &(0x7f0000002040)=0x40) 00:11:41 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040), &(0x7f0000000080)=0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000280)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX=r0, @ANYBLOB="0008004000000fff000000094e1b003800640000132b907800000000ac1414a08917afac1414aa7f000001ac141443ac1414bbe0100002860a0000000107040cf3000000"]}) r1 = getpgid(0x0) getpgid(r1) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x3a, 0x0, 0x8}) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000200), &(0x7f0000000240)=0x14) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000280)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX=r0, @ANYBLOB="0008004000000fff000000094e1b003800640000132b907800000000ac1414a08917afac1414aa7f000001ac141443ac1414bbe0100002860a0000000107040cf3000000"]}) (async) getpgid(0x0) (async) getpgid(r1) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x3a, 0x0, 0x8}) (async) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000200), &(0x7f0000000240)=0x14) (async) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x5}, 0x48) 00:11:41 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xa000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4b120fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x6}, 0x48) 00:11:41 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x240000c1}, 0x40000) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x7}, 0x48) 00:11:41 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x56e00fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040), &(0x7f0000000080)=0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000280)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX=r0, @ANYBLOB="0008004000000fff000000094e1b003800640000132b907800000000ac1414a08917afac1414aa7f000001ac141443ac1414bbe0100002860a0000000107040cf3000000"]}) r1 = getpgid(0x0) getpgid(r1) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x3a, 0x0, 0x8}) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000200), &(0x7f0000000240)=0x14) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) getsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000280)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX=r0, @ANYBLOB="0008004000000fff000000094e1b003800640000132b907800000000ac1414a08917afac1414aa7f000001ac141443ac1414bbe0100002860a0000000107040cf3000000"]}) (async) getpgid(0x0) (async) getpgid(r1) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x3a, 0x0, 0x8}) (async) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000200), &(0x7f0000000240)=0x14) (async) 00:11:41 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) r2 = syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r5 = socket(0x25, 0x2, 0x81) setsockopt$CAN_RAW_LOOPBACK(r5, 0x65, 0x3, &(0x7f0000000200)=0x1, 0x4) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x5, &(0x7f0000000040)=[{0x1840, 0x8, 0x6, 0x3}, {0x8e, 0x7a, 0x1f, 0x5}, {0x5, 0x4, 0x9, 0x9}, {0x7, 0x3, 0x2d, 0x9d7}, {0x9, 0x9, 0x2, 0x9ec3}]}) socketpair(0x29, 0x3, 0x8000, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000240)=@IORING_OP_SPLICE={0x1e, 0x4, 0x0, @fd=r7, 0x80000000, {0x0, r2}, 0x9, 0x7, 0x1, {0x0, 0x0, r6}}, 0x0) syz_io_uring_submit(r0, r4, &(0x7f0000000000)=@IORING_OP_FADVISE={0x18, 0x3, 0x0, @fd_index, 0x1, 0x0, 0x0, 0x2, 0x1}, 0x3f) 00:11:41 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xc000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x8}, 0x48) 00:11:41 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) r2 = syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r5 = socket(0x25, 0x2, 0x81) setsockopt$CAN_RAW_LOOPBACK(r5, 0x65, 0x3, &(0x7f0000000200)=0x1, 0x4) (async) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x5, &(0x7f0000000040)=[{0x1840, 0x8, 0x6, 0x3}, {0x8e, 0x7a, 0x1f, 0x5}, {0x5, 0x4, 0x9, 0x9}, {0x7, 0x3, 0x2d, 0x9d7}, {0x9, 0x9, 0x2, 0x9ec3}]}) socketpair(0x29, 0x3, 0x8000, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000240)=@IORING_OP_SPLICE={0x1e, 0x4, 0x0, @fd=r7, 0x80000000, {0x0, r2}, 0x9, 0x7, 0x1, {0x0, 0x0, r6}}, 0x0) (async) syz_io_uring_submit(r0, r4, &(0x7f0000000000)=@IORING_OP_FADVISE={0x18, 0x3, 0x0, @fd_index, 0x1, 0x0, 0x0, 0x2, 0x1}, 0x3f) 00:11:41 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000040)={&(0x7f0000ffb000/0x2000)=nil, 0xfffffffffffffffb, 0x3, 0x57}) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, &(0x7f0000000080)=0x3) mmap$dsp(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x4, 0x10010, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000100)={0x0, 0x2, r1, 0x5}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap$qrtrtun(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x110, 0xffffffffffffffff, 0x800) 00:11:41 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x56ffffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x9}, 0x48) 00:11:41 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) socketpair(0x10, 0x6, 0x3f, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f0000000100)={'sit0\x00', &(0x7f00000000c0)={@mcast1, @empty, 0x1a, 0xe}}) 00:11:41 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) (async) r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000040)={&(0x7f0000ffb000/0x2000)=nil, 0xfffffffffffffffb, 0x3, 0x57}) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, &(0x7f0000000080)=0x3) mmap$dsp(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x4, 0x10010, 0xffffffffffffffff, 0x0) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000100)={0x0, 0x2, r1, 0x5}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) mmap$qrtrtun(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x110, 0xffffffffffffffff, 0x800) (rerun: 64) 00:11:41 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) r2 = syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r5 = socket(0x25, 0x2, 0x81) setsockopt$CAN_RAW_LOOPBACK(r5, 0x65, 0x3, &(0x7f0000000200)=0x1, 0x4) (async) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x5, &(0x7f0000000040)=[{0x1840, 0x8, 0x6, 0x3}, {0x8e, 0x7a, 0x1f, 0x5}, {0x5, 0x4, 0x9, 0x9}, {0x7, 0x3, 0x2d, 0x9d7}, {0x9, 0x9, 0x2, 0x9ec3}]}) (async) socketpair(0x29, 0x3, 0x8000, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000240)=@IORING_OP_SPLICE={0x1e, 0x4, 0x0, @fd=r7, 0x80000000, {0x0, r2}, 0x9, 0x7, 0x1, {0x0, 0x0, r6}}, 0x0) (async) syz_io_uring_submit(r0, r4, &(0x7f0000000000)=@IORING_OP_FADVISE={0x18, 0x3, 0x0, @fd_index, 0x1, 0x0, 0x0, 0x2, 0x1}, 0x3f) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xa}, 0x48) 00:11:41 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x10000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xfeffffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:41 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xb}, 0x48) 00:11:41 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x6, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) 00:11:42 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000040)={&(0x7f0000ffb000/0x2000)=nil, 0xfffffffffffffffb, 0x3, 0x57}) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, &(0x7f0000000080)=0x3) mmap$dsp(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x4, 0x10010, 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000100)={0x0, 0x2, r1, 0x5}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap$qrtrtun(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x110, 0xffffffffffffffff, 0x800) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) (async) openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000, 0x0) (async) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000040)={&(0x7f0000ffb000/0x2000)=nil, 0xfffffffffffffffb, 0x3, 0x57}) (async) ioctl$USBDEVFS_CLAIM_PORT(0xffffffffffffffff, 0x80045518, &(0x7f0000000080)=0x3) (async) mmap$dsp(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x4, 0x10010, 0xffffffffffffffff, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000100)={0x0, 0x2, r1, 0x5}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) mmap$qrtrtun(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x110, 0xffffffffffffffff, 0x800) (async) 00:11:42 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x12000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xff0f004b}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xc}, 0x48) 00:11:42 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) socketpair(0x10, 0x6, 0x3f, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f0000000100)={'sit0\x00', &(0x7f00000000c0)={@mcast1, @empty, 0x1a, 0xe}}) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) socketpair(0x10, 0x6, 0x3f, &(0x7f0000000000)) (async) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f0000000100)={'sit0\x00', &(0x7f00000000c0)={@mcast1, @empty, 0x1a, 0xe}}) (async) 00:11:42 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x6, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x6, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) (async) 00:11:42 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$dsp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6, 0x10030, 0xffffffffffffffff, 0x0) 00:11:42 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xff0f124b}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xd}, 0x48) 00:11:42 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x18000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x6, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) 00:11:42 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$dsp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6, 0x10030, 0xffffffffffffffff, 0x0) 00:11:42 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xe}, 0x48) 00:11:42 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xff0fe056}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1e000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) socketpair(0x10, 0x6, 0x3f, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f0000000100)={'sit0\x00', &(0x7f00000000c0)={@mcast1, @empty, 0x1a, 0xe}}) 00:11:42 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$dsp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6, 0x10030, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$dsp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6, 0x10030, 0xffffffffffffffff, 0x0) (async) 00:11:42 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x80, &(0x7f0000ffa000/0x3000)=nil, 0x6) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffc000/0x1000)=nil) 00:11:42 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xf}, 0x48) 00:11:42 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffafff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 0: setsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x3, &(0x7f0000000000), 0x4) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000080)={0x4725, 0x7, [{0x1, 0x1}, {0xf, 0x1}, {0xc}, {0x5, 0x1}, {0xd, 0x1}, {0x2, 0x1}, {0xb}]}) ioctl$USBDEVFS_DISCARDURB(r0, 0x550b, &(0x7f0000000040)=0x6) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000040), 0x0) 00:11:42 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x80, &(0x7f0000ffa000/0x3000)=nil, 0x6) (async) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffc000/0x1000)=nil) 00:11:42 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x10}, 0x48) 00:11:42 executing program 0: setsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x3, &(0x7f0000000000), 0x4) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000080)={0x4725, 0x7, [{0x1, 0x1}, {0xf, 0x1}, {0xc}, {0x5, 0x1}, {0xd, 0x1}, {0x2, 0x1}, {0xb}]}) ioctl$USBDEVFS_DISCARDURB(r0, 0x550b, &(0x7f0000000040)=0x6) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000040), 0x0) setsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x3, &(0x7f0000000000), 0x4) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000080)={0x4725, 0x7, [{0x1, 0x1}, {0xf, 0x1}, {0xc}, {0x5, 0x1}, {0xd, 0x1}, {0x2, 0x1}, {0xb}]}) (async) ioctl$USBDEVFS_DISCARDURB(r0, 0x550b, &(0x7f0000000040)=0x6) (async) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000040), 0x0) (async) 00:11:42 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x11}, 0x48) 00:11:42 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffbfff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 64) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x80, &(0x7f0000ffa000/0x3000)=nil, 0x6) (async, rerun: 64) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffc000/0x1000)=nil) 00:11:42 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @private=0xa810100}, @dev={0xac, 0x14, 0x14, 0x1d}, 0x0, 0x14}}) 00:11:42 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x12}, 0x48) 00:11:42 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffff8000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 0: setsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x3, &(0x7f0000000000), 0x4) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000080)={0x4725, 0x7, [{0x1, 0x1}, {0xf, 0x1}, {0xc}, {0x5, 0x1}, {0xd, 0x1}, {0x2, 0x1}, {0xb}]}) ioctl$USBDEVFS_DISCARDURB(r0, 0x550b, &(0x7f0000000040)=0x6) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000040), 0x0) setsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x3, &(0x7f0000000000), 0x4) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000080)={0x4725, 0x7, [{0x1, 0x1}, {0xf, 0x1}, {0xc}, {0x5, 0x1}, {0xd, 0x1}, {0x2, 0x1}, {0xb}]}) (async) ioctl$USBDEVFS_DISCARDURB(r0, 0x550b, &(0x7f0000000040)=0x6) (async) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000040), 0x0) (async) 00:11:42 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffafff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 1: r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT(r0, 0x89e1, &(0x7f0000000000)={@local, @rand_addr=0x64010100}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:42 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x13}, 0x48) 00:11:42 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x460080, 0x0) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, &(0x7f0000000080)={"b24011f0415a5ee5a87bed78769e39f79118fa01c0ff95c3020a0a0ac7e9", 0xff, 0x2, 0x0, 0x2, 0x4, 0xffff, 0x2, 0x1, [0x7, 0x80, 0x61b, 0x3ff, 0x1f, 0x73c6b255, 0x3, 0xc9, 0x8, 0x59637dfe, 0xa3, 0x2, 0x80000000, 0x2, 0xcc3, 0x5, 0x6, 0x3, 0xd5]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}, 0x1}) 00:11:42 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffffff56}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:42 executing program 1: r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT(r0, 0x89e1, &(0x7f0000000000)={@local, @rand_addr=0x64010100}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$igmp(0x2, 0x3, 0x2) (async) ioctl$SIOCGETSGCNT(r0, 0x89e1, &(0x7f0000000000)={@local, @rand_addr=0x64010100}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:42 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x460080, 0x0) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, &(0x7f0000000080)={"b24011f0415a5ee5a87bed78769e39f79118fa01c0ff95c3020a0a0ac7e9", 0xff, 0x2, 0x0, 0x2, 0x4, 0xffff, 0x2, 0x1, [0x7, 0x80, 0x61b, 0x3ff, 0x1f, 0x73c6b255, 0x3, 0xc9, 0x8, 0x59637dfe, 0xa3, 0x2, 0x80000000, 0x2, 0xcc3, 0x5, 0x6, 0x3, 0xd5]}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}, 0x1}) 00:11:42 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffb000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @private=0xa810100}, @dev={0xac, 0x14, 0x14, 0x1d}, 0x0, 0x14}}) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x14}, 0x48) 00:11:43 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xfffffffe}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 1: r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT(r0, 0x89e1, &(0x7f0000000000)={@local, @rand_addr=0x64010100}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:43 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffbfff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x460080, 0x0) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, &(0x7f0000000080)={"b24011f0415a5ee5a87bed78769e39f79118fa01c0ff95c3020a0a0ac7e9", 0xff, 0x2, 0x0, 0x2, 0x4, 0xffff, 0x2, 0x1, [0x7, 0x80, 0x61b, 0x3ff, 0x1f, 0x73c6b255, 0x3, 0xc9, 0x8, 0x59637dfe, 0xa3, 0x2, 0x80000000, 0x2, 0xcc3, 0x5, 0x6, 0x3, 0xd5]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}, 0x1}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x460080, 0x0) (async) ioctl$SNDCTL_SYNTH_ID(r0, 0xc08c5114, &(0x7f0000000080)={"b24011f0415a5ee5a87bed78769e39f79118fa01c0ff95c3020a0a0ac7e9", 0xff, 0x2, 0x0, 0x2, 0x4, 0xffff, 0x2, 0x1, [0x7, 0x80, 0x61b, 0x3ff, 0x1f, 0x73c6b255, 0x3, 0xc9, 0x8, 0x59637dfe, 0xa3, 0x2, 0x80000000, 0x2, 0xcc3, 0x5, 0x6, 0x3, 0xd5]}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}, 0x1}) (async) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x15}, 0x48) 00:11:43 executing program 1: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) mmap$qrtrtun(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x5, 0x2010, 0xffffffffffffffff, 0x967) 00:11:43 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ffc000/0x3000)=nil) mremap(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ff9000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) ioctl$SOUND_MIXER_INFO(r1, 0x805c4d65, &(0x7f00000000c0)) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r3, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000140)={"969191622e13356aa34fd163dba054981538e8282eca6df724b234d4f1bd", 0x0, 0x400, 0x2, [0x6876, 0x1, 0x75d14fcb, 0x7, 0x10001, 0x3, 0x1, 0x3, 0xfffffffb, 0x8, 0x5, 0x6, 0xfff, 0x10001, 0xbdd, 0x4, 0xffffffff, 0x81]}) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@remote, @local, 0x16, 0x8}}) 00:11:43 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffc000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x16}, 0x48) 00:11:43 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @private=0xa810100}, @dev={0xac, 0x14, 0x14, 0x1d}, 0x0, 0x14}}) 00:11:43 executing program 1: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) mmap$qrtrtun(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x5, 0x2010, 0xffffffffffffffff, 0x967) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$qrtrtun(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x5, 0x2010, 0xffffffffffffffff, 0x967) (async) 00:11:43 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x21010000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ffc000/0x3000)=nil) (async) mremap(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ff9000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) ioctl$SOUND_MIXER_INFO(r1, 0x805c4d65, &(0x7f00000000c0)) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r3, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000140)={"969191622e13356aa34fd163dba054981538e8282eca6df724b234d4f1bd", 0x0, 0x400, 0x2, [0x6876, 0x1, 0x75d14fcb, 0x7, 0x10001, 0x3, 0x1, 0x3, 0xfffffffb, 0x8, 0x5, 0x6, 0xfff, 0x10001, 0xbdd, 0x4, 0xffffffff, 0x81]}) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@remote, @local, 0x16, 0x8}}) 00:11:43 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x17}, 0x48) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x18}, 0x48) 00:11:43 executing program 1: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$qrtrtun(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x5, 0x2010, 0xffffffffffffffff, 0x967) 00:11:43 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x24000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ffc000/0x3000)=nil) (async) mremap(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ff9000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) (async) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) ioctl$SOUND_MIXER_INFO(r1, 0x805c4d65, &(0x7f00000000c0)) (async) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r3, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000140)={"969191622e13356aa34fd163dba054981538e8282eca6df724b234d4f1bd", 0x0, 0x400, 0x2, [0x6876, 0x1, 0x75d14fcb, 0x7, 0x10001, 0x3, 0x1, 0x3, 0xfffffffb, 0x8, 0x5, 0x6, 0xfff, 0x10001, 0xbdd, 0x4, 0xffffffff, 0x81]}) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@remote, @local, 0x16, 0x8}}) 00:11:43 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x19}, 0x48) 00:11:43 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) read$sequencer(r1, &(0x7f00000000c0)=""/176, 0xb0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:43 executing program 1: setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000000)="4e168065c1b4e47f19c8b827618725aed8c1d40e727adc464cdfe44e6fe4e4eb2c55ff721d8de308d9e3b55fdba3b0929741b90af62c219ebfd86e0dab9ad6f3fcb33b14e061b47638400282a7cf75f20d5fa16473575a272a38baf40563e4310e4d3f", 0x63) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000001200)=0x1, 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000001100), r1) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_TMR_STOP(r2, 0x5403) socketpair(0xf, 0xa, 0x1, &(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r5, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000001300)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)={0x24, r5, 0x200, 0x70bd29, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xfff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x20004000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r6, 0xaf02, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000001080)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/97, 0x61, 0x1, &(0x7f0000000080)=""/4096, 0x1000}, &(0x7f00000010c0)=0x40) 00:11:43 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x24030000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1a}, 0x48) 00:11:43 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 1: setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000000)="4e168065c1b4e47f19c8b827618725aed8c1d40e727adc464cdfe44e6fe4e4eb2c55ff721d8de308d9e3b55fdba3b0929741b90af62c219ebfd86e0dab9ad6f3fcb33b14e061b47638400282a7cf75f20d5fa16473575a272a38baf40563e4310e4d3f", 0x63) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:43 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x26030000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x6}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1b}, 0x48) 00:11:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000001200)=0x1, 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000001100), r1) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_TMR_STOP(r2, 0x5403) socketpair(0xf, 0xa, 0x1, &(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r5, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000001300)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)={0x24, r5, 0x200, 0x70bd29, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xfff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x20004000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r6, 0xaf02, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000001080)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/97, 0x61, 0x1, &(0x7f0000000080)=""/4096, 0x1000}, &(0x7f00000010c0)=0x40) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000001200)=0x1, 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000001100), r1) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_TMR_STOP(r2, 0x5403) (async) socketpair(0xf, 0xa, 0x1, &(0x7f0000001180)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r5, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000001300)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)={0x24, r5, 0x200, 0x70bd29, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xfff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x20004000) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) openat$vnet(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) (async) ioctl$VHOST_RESET_OWNER(r6, 0xaf02, 0x0) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000001080)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/97, 0x61, 0x1, &(0x7f0000000080)=""/4096, 0x1000}, &(0x7f00000010c0)=0x40) (async) 00:11:43 executing program 1: setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000000)="4e168065c1b4e47f19c8b827618725aed8c1d40e727adc464cdfe44e6fe4e4eb2c55ff721d8de308d9e3b55fdba3b0929741b90af62c219ebfd86e0dab9ad6f3fcb33b14e061b47638400282a7cf75f20d5fa16473575a272a38baf40563e4310e4d3f", 0x63) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1c}, 0x48) 00:11:43 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x1d) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil) 00:11:43 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) read$sequencer(r1, &(0x7f00000000c0)=""/176, 0xb0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) socket$inet_udp(0x2, 0x2, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) (async) read$sequencer(r1, &(0x7f00000000c0)=""/176, 0xb0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) 00:11:43 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000001200)=0x1, 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000001100), r1) (async, rerun: 64) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (rerun: 64) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) (async, rerun: 64) ioctl$SNDCTL_TMR_STOP(r2, 0x5403) (rerun: 64) socketpair(0xf, 0xa, 0x1, &(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r5, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000001300)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)={0x24, r5, 0x200, 0x70bd29, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0xfff}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x20004000) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r6, 0xaf02, 0x0) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000001080)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/97, 0x61, 0x1, &(0x7f0000000080)=""/4096, 0x1000}, &(0x7f00000010c0)=0x40) 00:11:43 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1d}, 0x48) 00:11:43 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x1d) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x1d) (async) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil) (async) 00:11:43 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x30000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:43 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) read$sequencer(r1, &(0x7f00000000c0)=""/176, 0xb0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:44 executing program 0: clock_gettime(0x0, &(0x7f0000000100)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000040)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x2, 0xffffffffffffffff, 0x30, 0x0, @in6={0xa, 0x4e21, 0x4, @local, 0x7}}}, 0xa0) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1e}, 0x48) 00:11:44 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x1d) (async) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xa000, 0x4, &(0x7f0000ff6000/0xa000)=nil) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x9}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 0: clock_gettime(0x0, &(0x7f0000000100)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000040)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x2, 0xffffffffffffffff, 0x30, 0x0, @in6={0xa, 0x4e21, 0x4, @local, 0x7}}}, 0xa0) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x21}, 0x48) 00:11:44 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x36000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xa}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 1: mremap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) 00:11:44 executing program 0: clock_gettime(0x0, &(0x7f0000000100)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000040)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x2, 0xffffffffffffffff, 0x30, 0x0, @in6={0xa, 0x4e21, 0x4, @local, 0x7}}}, 0xa0) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x22}, 0x48) 00:11:44 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) setsockopt$MRT_DONE(0xffffffffffffffff, 0x0, 0xc9, 0x0, 0x0) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xc}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x39030000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) syz_io_uring_setup(0x3fe6, &(0x7f0000000100)={0x0, 0xb83d, 0x8, 0x2, 0xe4, 0x0, r0}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000180), &(0x7f0000000480)=0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) syz_io_uring_submit(0x0, r1, &(0x7f0000000240)=@IORING_OP_FILES_UPDATE={0x14, 0x1, 0x0, 0x0, 0xfffffffffffffffa, &(0x7f0000000200)=[r2], 0x1, 0x0, 0x1}, 0x726) bpf$MAP_CREATE(0x1e, 0x0, 0x0) r3 = syz_io_uring_setup(0x75db, &(0x7f0000000000)={0x0, 0xe40a, 0x10, 0x2, 0x299, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r4 = syz_io_uring_setup(0x32d, &(0x7f0000000280)={0x0, 0x512d, 0x8, 0x0, 0x9f, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) syz_io_uring_setup(0x3d32, &(0x7f0000000380)={0x0, 0xdb62, 0x20, 0x2, 0x2cb, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000400), &(0x7f0000000440)) 00:11:44 executing program 1: mremap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x23}, 0x48) 00:11:44 executing program 1: mremap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) mremap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) (async) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x300}, 0x48) 00:11:44 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3c000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000000)=0x7ed, 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$packet(0x11, 0x2, 0x300) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x10}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) setsockopt$MRT_DONE(0xffffffffffffffff, 0x0, 0xc9, 0x0, 0x0) 00:11:44 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) syz_io_uring_setup(0x3fe6, &(0x7f0000000100)={0x0, 0xb83d, 0x8, 0x2, 0xe4, 0x0, r0}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000180), &(0x7f0000000480)=0x0) (async) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) syz_io_uring_submit(0x0, r1, &(0x7f0000000240)=@IORING_OP_FILES_UPDATE={0x14, 0x1, 0x0, 0x0, 0xfffffffffffffffa, &(0x7f0000000200)=[r2], 0x1, 0x0, 0x1}, 0x726) bpf$MAP_CREATE(0x1e, 0x0, 0x0) (async) r3 = syz_io_uring_setup(0x75db, &(0x7f0000000000)={0x0, 0xe40a, 0x10, 0x2, 0x299, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r4 = syz_io_uring_setup(0x32d, &(0x7f0000000280)={0x0, 0x512d, 0x8, 0x0, 0x9f, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) syz_io_uring_setup(0x3d32, &(0x7f0000000380)={0x0, 0xdb62, 0x20, 0x2, 0x2cb, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000400), &(0x7f0000000440)) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x461}, 0x48) 00:11:44 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3d000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000000)=0x7ed, 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$packet(0x11, 0x2, 0x300) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x12}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x500}, 0x48) 00:11:44 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 1: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000000)=0x7ed, 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$packet(0x11, 0x2, 0x300) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x18}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async, rerun: 64) syz_io_uring_setup(0x3fe6, &(0x7f0000000100)={0x0, 0xb83d, 0x8, 0x2, 0xe4, 0x0, r0}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000180), &(0x7f0000000480)=0x0) (async, rerun: 64) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) syz_io_uring_submit(0x0, r1, &(0x7f0000000240)=@IORING_OP_FILES_UPDATE={0x14, 0x1, 0x0, 0x0, 0xfffffffffffffffa, &(0x7f0000000200)=[r2], 0x1, 0x0, 0x1}, 0x726) (async) bpf$MAP_CREATE(0x1e, 0x0, 0x0) r3 = syz_io_uring_setup(0x75db, &(0x7f0000000000)={0x0, 0xe40a, 0x10, 0x2, 0x299, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) r4 = syz_io_uring_setup(0x32d, &(0x7f0000000280)={0x0, 0x512d, 0x8, 0x0, 0x9f, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) syz_io_uring_setup(0x3d32, &(0x7f0000000380)={0x0, 0xdb62, 0x20, 0x2, 0x2cb, 0x0, r4}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000400), &(0x7f0000000440)) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1e}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) setsockopt$MRT_DONE(0xffffffffffffffff, 0x0, 0xc9, 0x0, 0x0) 00:11:44 executing program 1: ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x2, &(0x7f0000ffb000/0x1000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x7fffffff, 0x3}) mmap$usbfs(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000006, 0x100010, 0xffffffffffffffff, 0x8) r0 = socket(0x21, 0x6, 0x6bb7aaf7) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000000c0)=@IORING_OP_WRITE_FIXED={0x5, 0x3, 0x0, @fd_index=0x2, 0x5, 0x6, 0x8, 0x0, 0x1}, 0x1) setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f0000000040)=0x8000, 0x4) 00:11:44 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x40000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x600}, 0x48) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x24}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 0: socket$igmp(0x2, 0x3, 0x2) socketpair(0xa, 0x4, 0xf64, &(0x7f0000000040)) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@loopback, @mcast2}) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20041, 0x0) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}) ioctl$SIOCGETSGCNT_IN6(r1, 0x89e1, &(0x7f00000000c0)={@local, @private0}) 00:11:44 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x700}, 0x48) 00:11:44 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2a}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x42000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:44 executing program 0: socket$igmp(0x2, 0x3, 0x2) (async) socketpair(0xa, 0x4, 0xf64, &(0x7f0000000040)) (async) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@loopback, @mcast2}) (async) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20041, 0x0) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}) ioctl$SIOCGETSGCNT_IN6(r1, 0x89e1, &(0x7f00000000c0)={@local, @private0}) 00:11:44 executing program 1: ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000080)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x2, &(0x7f0000ffb000/0x1000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x7fffffff, 0x3}) (async) mmap$usbfs(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000006, 0x100010, 0xffffffffffffffff, 0x8) (async) r0 = socket(0x21, 0x6, 0x6bb7aaf7) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async) syz_io_uring_submit(0x0, r2, &(0x7f00000000c0)=@IORING_OP_WRITE_FIXED={0x5, 0x3, 0x0, @fd_index=0x2, 0x5, 0x6, 0x8, 0x0, 0x1}, 0x1) setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f0000000040)=0x8000, 0x4) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x900}, 0x48) 00:11:45 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0x1, 0x1, 0x5, 0x8, @vifc_lcl_ifindex=r2, @loopback}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@loopback, @local, 0x1b, 0x4}}) socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) socket$inet_udplite(0x2, 0x2, 0x88) 00:11:45 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x55400fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 0: socket$igmp(0x2, 0x3, 0x2) (async) socketpair(0xa, 0x4, 0xf64, &(0x7f0000000040)) (async) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@loopback, @mcast2}) (async) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20041, 0x0) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}) ioctl$SIOCGETSGCNT_IN6(r1, 0x89e1, &(0x7f00000000c0)={@local, @private0}) 00:11:45 executing program 1: ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x2, &(0x7f0000ffb000/0x1000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x7fffffff, 0x3}) mmap$usbfs(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000006, 0x100010, 0xffffffffffffffff, 0x8) r0 = socket(0x21, 0x6, 0x6bb7aaf7) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000000c0)=@IORING_OP_WRITE_FIXED={0x5, 0x3, 0x0, @fd_index=0x2, 0x5, 0x6, 0x8, 0x0, 0x1}, 0x1) setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f0000000040)=0x8000, 0x4) ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000080)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) prctl$PR_SET_MM(0x23, 0x2, &(0x7f0000ffb000/0x1000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x7fffffff, 0x3}) (async) mmap$usbfs(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000006, 0x100010, 0xffffffffffffffff, 0x8) (async) socket(0x21, 0x6, 0x6bb7aaf7) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (async) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async) syz_io_uring_submit(0x0, r2, &(0x7f00000000c0)=@IORING_OP_WRITE_FIXED={0x5, 0x3, 0x0, @fd_index=0x2, 0x5, 0x6, 0x8, 0x0, 0x1}, 0x1) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f0000000040)=0x8000, 0x4) (async) 00:11:45 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x30}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xa00}, 0x48) 00:11:45 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) mremap(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) mmap$usbfs(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x1010, r0, 0x5) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xffffffffffffffff, 0xcc000) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0x800, 0x242) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000280)=@urb_type_iso={0x0, {0x9}, 0x1, 0x84, &(0x7f0000000180)="93e1b7d5148fe064c4a4430441c845788d924283dea12a14497b860ab75d078754ca04c715d72abab1ce508bf2fa9de9f594b467cd469865b3ea5721429a713b351488c0eb5dce2820", 0x49, 0x8, 0x81, 0x7f, 0x7fffffff, 0x3, &(0x7f0000000200)="a1d5496ccc241851dc13bf228ce8565daca35f49c7c5301c877d612e921393094bad8c6538197b11fa98f1777c22b03c1967622989e6e4748c8dad91245dee6c99847619ffa9719c716c1b1512279973e9d5a3a57f9e644ccb7d870dfc7a94f521bd018c8a", [{0x58, 0x8, 0x401}, {0x8001, 0x4, 0x7fff}, {0x52e0, 0x2, 0x6}, {0x0, 0x4, 0x8}, {0x3, 0x2, 0x3}, {0x7f, 0x80, 0x1a}, {0x7, 0xff, 0x3}, {0x4, 0xd6c, 0x20002000}, {0x6442, 0x582, 0x9}, {0xe2, 0x81, 0x5d80}, {0x4, 0x0, 0x6}, {0x5, 0x400, 0x8}, {0x1, 0x2, 0x1}, {0x8, 0x15ca, 0x6126}, {0x1, 0xbc26, 0x6}, {0x0, 0x9, 0xf485}, {0x4, 0xbdf, 0x800}, {0x4, 0x20, 0xffffffde}, {0xb68, 0x8}, {0x335, 0x0, 0x7f}, {0x2, 0x0, 0x1}, {0xeee2, 0x8, 0x9}, {0x800000, 0x10000, 0x9}, {0x1, 0xff, 0x400}, {0x3, 0x6f9a, 0x2400}, {0x1f, 0xffff, 0x3}, {0x1, 0x86c, 0x7b}, {0x1, 0x1000, 0x1}, {0x400, 0x8106, 0xffff8000}, {0x800, 0xa7, 0xffffff7f}, {0x80, 0x48e0, 0x4}, {0x7, 0x10001, 0x7f}, {0x4, 0x8000, 0xca13}, {0x3, 0x1, 0xfffffff9}, {0x5, 0x4, 0x8}, {0x80, 0x2, 0x6}, {0x0, 0x7f, 0x5}, {0x0, 0x8722, 0xfffffffb}, {0xfffffffe, 0x6, 0x7}, {0x1, 0x8000, 0xffff0001}, {0xd96, 0x2, 0x58}, {0x1ff, 0x2, 0x61}, {0x5a, 0xd9be, 0x7}, {0x4, 0x996}, {0x0, 0xa15f, 0x3ff}, {0x3, 0x0, 0x7}, {0xfffffffa, 0x481, 0x113}, {0x3, 0xff, 0x6}, {0x9, 0x7f, 0x3ff}, {0x800, 0x8, 0x8}, {0x85c00000, 0x5, 0x1f}, {0x7, 0x61f, 0xffffffff}, {0x911f37df, 0x4, 0x657c}, {0x800, 0x779, 0x7b2}, {0x7fff, 0x6, 0x6}, {0x401, 0x4, 0x2}, {0x7, 0x5, 0x19}, {0x1ff, 0x3f, 0x81}, {0xec3, 0x341}, {0xff, 0x8, 0x80}, {0x2, 0x9, 0x1}, {0x8000, 0x0, 0x41245ca}, {0x3f, 0x100, 0x1}, {0x9, 0x6, 0x5}, {0x0, 0x2, 0x7}, {0x10000, 0x8, 0x40000003}, {0x1f, 0x8, 0x9}, {0x6, 0x7f, 0x6}, {0x7, 0xa06d, 0x9}, {0x8, 0x2, 0x400}, {0x2ad9, 0x7, 0x80000000}, {0x6e, 0x0, 0x7}, {0x0, 0x9, 0x3}, {0x1ff, 0xc4, 0x7}, {0x0, 0x4, 0xffffffff}, {0x9d, 0xfffffff9, 0x7fffffff}, {0x9, 0x6, 0x3}, {0x3, 0x500, 0x4}, {0x6, 0x6, 0x9}, {0x101, 0x20, 0x5}, {0x9f, 0x3, 0x9}, {0x5, 0xe11, 0x5652cfe6}, {0xc1f00000, 0x9, 0x6}, {0x6, 0x81, 0x6}, {0x5, 0xffff8692, 0x3}, {0x326b59f7, 0x5, 0x9}, {0x3, 0x1}, {0x1, 0x7, 0x5}, {0x6, 0x2, 0x7}, {0x7, 0x1, 0x9}, {0x9, 0xc5b}, {0x2, 0x9, 0x5}, {0x4, 0xf6b, 0xfffffffe}, {0x8, 0x7, 0x5}, {0x8, 0x2}, {0x5, 0x10000, 0x40}, {0x9, 0x9, 0x1}, {0xffff, 0x1, 0x2}, {0x4, 0x5, 0x2}, {0xffffffff, 0x2649, 0x10000}, {0x7, 0x2, 0x3}, {0x7, 0x35, 0x8}, {0x1f, 0x200, 0x40}, {0x30000, 0x101, 0x7}, {0x73f3, 0x80000001}, {0xff, 0x0, 0x40}, {0x80000001, 0xc82, 0x1ff}, {0x4, 0xffff77ca, 0x3}, {0x100, 0x0, 0x2}, {0x0, 0x6, 0x1ff}, {0x7fff, 0x8, 0x1000}, {0x0, 0x7, 0x2}, {0x1, 0x5, 0x800}, {0xfffffffc, 0x6, 0x4}, {0x3, 0x7f, 0x8}, {0x2, 0x7f, 0x3}, {0x1000, 0x7, 0xffff}, {0x137, 0x4, 0x6}, {0x7f, 0x2, 0x1}, {0x8, 0x2, 0x1000}, {0x1, 0xf46, 0xcd}, {0x2, 0xffffffba, 0x1}, {0x2, 0x8, 0x7}, {0x4800, 0x0, 0x400}, {0x6, 0x6, 0x6}, {0x7fff, 0xe89e, 0x40}, {0x2, 0x9, 0x9}]}) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x6) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom1\x00', 0x3, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x81) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x80000000) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f0000000080)={0x6, &(0x7f0000000040)="6f4dd333250287f7a6b64ada2a796f2b2b027ca52af80baeb74ecc75c5fbf72d1cacc0933abe27ec34d26d5c83e857b320994f0a82c9db"}) 00:11:45 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x36}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xb00}, 0x48) 00:11:45 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x55520fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000, 0x138bd076fb8f3106, &(0x7f0000ffb000/0x2000)=nil) 00:11:45 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) mremap(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async, rerun: 64) mmap$usbfs(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x1010, r0, 0x5) (async, rerun: 64) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xffffffffffffffff, 0xcc000) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) (async) r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0x800, 0x242) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000280)=@urb_type_iso={0x0, {0x9}, 0x1, 0x84, &(0x7f0000000180)="93e1b7d5148fe064c4a4430441c845788d924283dea12a14497b860ab75d078754ca04c715d72abab1ce508bf2fa9de9f594b467cd469865b3ea5721429a713b351488c0eb5dce2820", 0x49, 0x8, 0x81, 0x7f, 0x7fffffff, 0x3, &(0x7f0000000200)="a1d5496ccc241851dc13bf228ce8565daca35f49c7c5301c877d612e921393094bad8c6538197b11fa98f1777c22b03c1967622989e6e4748c8dad91245dee6c99847619ffa9719c716c1b1512279973e9d5a3a57f9e644ccb7d870dfc7a94f521bd018c8a", [{0x58, 0x8, 0x401}, {0x8001, 0x4, 0x7fff}, {0x52e0, 0x2, 0x6}, {0x0, 0x4, 0x8}, {0x3, 0x2, 0x3}, {0x7f, 0x80, 0x1a}, {0x7, 0xff, 0x3}, {0x4, 0xd6c, 0x20002000}, {0x6442, 0x582, 0x9}, {0xe2, 0x81, 0x5d80}, {0x4, 0x0, 0x6}, {0x5, 0x400, 0x8}, {0x1, 0x2, 0x1}, {0x8, 0x15ca, 0x6126}, {0x1, 0xbc26, 0x6}, {0x0, 0x9, 0xf485}, {0x4, 0xbdf, 0x800}, {0x4, 0x20, 0xffffffde}, {0xb68, 0x8}, {0x335, 0x0, 0x7f}, {0x2, 0x0, 0x1}, {0xeee2, 0x8, 0x9}, {0x800000, 0x10000, 0x9}, {0x1, 0xff, 0x400}, {0x3, 0x6f9a, 0x2400}, {0x1f, 0xffff, 0x3}, {0x1, 0x86c, 0x7b}, {0x1, 0x1000, 0x1}, {0x400, 0x8106, 0xffff8000}, {0x800, 0xa7, 0xffffff7f}, {0x80, 0x48e0, 0x4}, {0x7, 0x10001, 0x7f}, {0x4, 0x8000, 0xca13}, {0x3, 0x1, 0xfffffff9}, {0x5, 0x4, 0x8}, {0x80, 0x2, 0x6}, {0x0, 0x7f, 0x5}, {0x0, 0x8722, 0xfffffffb}, {0xfffffffe, 0x6, 0x7}, {0x1, 0x8000, 0xffff0001}, {0xd96, 0x2, 0x58}, {0x1ff, 0x2, 0x61}, {0x5a, 0xd9be, 0x7}, {0x4, 0x996}, {0x0, 0xa15f, 0x3ff}, {0x3, 0x0, 0x7}, {0xfffffffa, 0x481, 0x113}, {0x3, 0xff, 0x6}, {0x9, 0x7f, 0x3ff}, {0x800, 0x8, 0x8}, {0x85c00000, 0x5, 0x1f}, {0x7, 0x61f, 0xffffffff}, {0x911f37df, 0x4, 0x657c}, {0x800, 0x779, 0x7b2}, {0x7fff, 0x6, 0x6}, {0x401, 0x4, 0x2}, {0x7, 0x5, 0x19}, {0x1ff, 0x3f, 0x81}, {0xec3, 0x341}, {0xff, 0x8, 0x80}, {0x2, 0x9, 0x1}, {0x8000, 0x0, 0x41245ca}, {0x3f, 0x100, 0x1}, {0x9, 0x6, 0x5}, {0x0, 0x2, 0x7}, {0x10000, 0x8, 0x40000003}, {0x1f, 0x8, 0x9}, {0x6, 0x7f, 0x6}, {0x7, 0xa06d, 0x9}, {0x8, 0x2, 0x400}, {0x2ad9, 0x7, 0x80000000}, {0x6e, 0x0, 0x7}, {0x0, 0x9, 0x3}, {0x1ff, 0xc4, 0x7}, {0x0, 0x4, 0xffffffff}, {0x9d, 0xfffffff9, 0x7fffffff}, {0x9, 0x6, 0x3}, {0x3, 0x500, 0x4}, {0x6, 0x6, 0x9}, {0x101, 0x20, 0x5}, {0x9f, 0x3, 0x9}, {0x5, 0xe11, 0x5652cfe6}, {0xc1f00000, 0x9, 0x6}, {0x6, 0x81, 0x6}, {0x5, 0xffff8692, 0x3}, {0x326b59f7, 0x5, 0x9}, {0x3, 0x1}, {0x1, 0x7, 0x5}, {0x6, 0x2, 0x7}, {0x7, 0x1, 0x9}, {0x9, 0xc5b}, {0x2, 0x9, 0x5}, {0x4, 0xf6b, 0xfffffffe}, {0x8, 0x7, 0x5}, {0x8, 0x2}, {0x5, 0x10000, 0x40}, {0x9, 0x9, 0x1}, {0xffff, 0x1, 0x2}, {0x4, 0x5, 0x2}, {0xffffffff, 0x2649, 0x10000}, {0x7, 0x2, 0x3}, {0x7, 0x35, 0x8}, {0x1f, 0x200, 0x40}, {0x30000, 0x101, 0x7}, {0x73f3, 0x80000001}, {0xff, 0x0, 0x40}, {0x80000001, 0xc82, 0x1ff}, {0x4, 0xffff77ca, 0x3}, {0x100, 0x0, 0x2}, {0x0, 0x6, 0x1ff}, {0x7fff, 0x8, 0x1000}, {0x0, 0x7, 0x2}, {0x1, 0x5, 0x800}, {0xfffffffc, 0x6, 0x4}, {0x3, 0x7f, 0x8}, {0x2, 0x7f, 0x3}, {0x1000, 0x7, 0xffff}, {0x137, 0x4, 0x6}, {0x7f, 0x2, 0x1}, {0x8, 0x2, 0x1000}, {0x1, 0xf46, 0xcd}, {0x2, 0xffffffba, 0x1}, {0x2, 0x8, 0x7}, {0x4800, 0x0, 0x400}, {0x6, 0x6, 0x6}, {0x7fff, 0xe89e, 0x40}, {0x2, 0x9, 0x9}]}) (async) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x6) (async) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom1\x00', 0x3, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x81) (async) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) (async) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x80000000) (async) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f0000000080)={0x6, &(0x7f0000000040)="6f4dd333250287f7a6b64ada2a796f2b2b027ca52af80baeb74ecc75c5fbf72d1cacc0933abe27ec34d26d5c83e857b320994f0a82c9db"}) 00:11:45 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0x1, 0x1, 0x5, 0x8, @vifc_lcl_ifindex=r2, @loopback}, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@loopback, @local, 0x1b, 0x4}}) (async) socket$phonet_pipe(0x23, 0x5, 0x2) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) socket$inet_udplite(0x2, 0x2, 0x88) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xc00}, 0x48) 00:11:45 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3c}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x55600fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000, 0x138bd076fb8f3106, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mremap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000, 0x138bd076fb8f3106, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:45 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) mremap(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) mmap$usbfs(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x1010, r0, 0x5) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xffffffffffffffff, 0xcc000) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0x800, 0x242) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000280)=@urb_type_iso={0x0, {0x9}, 0x1, 0x84, &(0x7f0000000180)="93e1b7d5148fe064c4a4430441c845788d924283dea12a14497b860ab75d078754ca04c715d72abab1ce508bf2fa9de9f594b467cd469865b3ea5721429a713b351488c0eb5dce2820", 0x49, 0x8, 0x81, 0x7f, 0x7fffffff, 0x3, &(0x7f0000000200)="a1d5496ccc241851dc13bf228ce8565daca35f49c7c5301c877d612e921393094bad8c6538197b11fa98f1777c22b03c1967622989e6e4748c8dad91245dee6c99847619ffa9719c716c1b1512279973e9d5a3a57f9e644ccb7d870dfc7a94f521bd018c8a", [{0x58, 0x8, 0x401}, {0x8001, 0x4, 0x7fff}, {0x52e0, 0x2, 0x6}, {0x0, 0x4, 0x8}, {0x3, 0x2, 0x3}, {0x7f, 0x80, 0x1a}, {0x7, 0xff, 0x3}, {0x4, 0xd6c, 0x20002000}, {0x6442, 0x582, 0x9}, {0xe2, 0x81, 0x5d80}, {0x4, 0x0, 0x6}, {0x5, 0x400, 0x8}, {0x1, 0x2, 0x1}, {0x8, 0x15ca, 0x6126}, {0x1, 0xbc26, 0x6}, {0x0, 0x9, 0xf485}, {0x4, 0xbdf, 0x800}, {0x4, 0x20, 0xffffffde}, {0xb68, 0x8}, {0x335, 0x0, 0x7f}, {0x2, 0x0, 0x1}, {0xeee2, 0x8, 0x9}, {0x800000, 0x10000, 0x9}, {0x1, 0xff, 0x400}, {0x3, 0x6f9a, 0x2400}, {0x1f, 0xffff, 0x3}, {0x1, 0x86c, 0x7b}, {0x1, 0x1000, 0x1}, {0x400, 0x8106, 0xffff8000}, {0x800, 0xa7, 0xffffff7f}, {0x80, 0x48e0, 0x4}, {0x7, 0x10001, 0x7f}, {0x4, 0x8000, 0xca13}, {0x3, 0x1, 0xfffffff9}, {0x5, 0x4, 0x8}, {0x80, 0x2, 0x6}, {0x0, 0x7f, 0x5}, {0x0, 0x8722, 0xfffffffb}, {0xfffffffe, 0x6, 0x7}, {0x1, 0x8000, 0xffff0001}, {0xd96, 0x2, 0x58}, {0x1ff, 0x2, 0x61}, {0x5a, 0xd9be, 0x7}, {0x4, 0x996}, {0x0, 0xa15f, 0x3ff}, {0x3, 0x0, 0x7}, {0xfffffffa, 0x481, 0x113}, {0x3, 0xff, 0x6}, {0x9, 0x7f, 0x3ff}, {0x800, 0x8, 0x8}, {0x85c00000, 0x5, 0x1f}, {0x7, 0x61f, 0xffffffff}, {0x911f37df, 0x4, 0x657c}, {0x800, 0x779, 0x7b2}, {0x7fff, 0x6, 0x6}, {0x401, 0x4, 0x2}, {0x7, 0x5, 0x19}, {0x1ff, 0x3f, 0x81}, {0xec3, 0x341}, {0xff, 0x8, 0x80}, {0x2, 0x9, 0x1}, {0x8000, 0x0, 0x41245ca}, {0x3f, 0x100, 0x1}, {0x9, 0x6, 0x5}, {0x0, 0x2, 0x7}, {0x10000, 0x8, 0x40000003}, {0x1f, 0x8, 0x9}, {0x6, 0x7f, 0x6}, {0x7, 0xa06d, 0x9}, {0x8, 0x2, 0x400}, {0x2ad9, 0x7, 0x80000000}, {0x6e, 0x0, 0x7}, {0x0, 0x9, 0x3}, {0x1ff, 0xc4, 0x7}, {0x0, 0x4, 0xffffffff}, {0x9d, 0xfffffff9, 0x7fffffff}, {0x9, 0x6, 0x3}, {0x3, 0x500, 0x4}, {0x6, 0x6, 0x9}, {0x101, 0x20, 0x5}, {0x9f, 0x3, 0x9}, {0x5, 0xe11, 0x5652cfe6}, {0xc1f00000, 0x9, 0x6}, {0x6, 0x81, 0x6}, {0x5, 0xffff8692, 0x3}, {0x326b59f7, 0x5, 0x9}, {0x3, 0x1}, {0x1, 0x7, 0x5}, {0x6, 0x2, 0x7}, {0x7, 0x1, 0x9}, {0x9, 0xc5b}, {0x2, 0x9, 0x5}, {0x4, 0xf6b, 0xfffffffe}, {0x8, 0x7, 0x5}, {0x8, 0x2}, {0x5, 0x10000, 0x40}, {0x9, 0x9, 0x1}, {0xffff, 0x1, 0x2}, {0x4, 0x5, 0x2}, {0xffffffff, 0x2649, 0x10000}, {0x7, 0x2, 0x3}, {0x7, 0x35, 0x8}, {0x1f, 0x200, 0x40}, {0x30000, 0x101, 0x7}, {0x73f3, 0x80000001}, {0xff, 0x0, 0x40}, {0x80000001, 0xc82, 0x1ff}, {0x4, 0xffff77ca, 0x3}, {0x100, 0x0, 0x2}, {0x0, 0x6, 0x1ff}, {0x7fff, 0x8, 0x1000}, {0x0, 0x7, 0x2}, {0x1, 0x5, 0x800}, {0xfffffffc, 0x6, 0x4}, {0x3, 0x7f, 0x8}, {0x2, 0x7f, 0x3}, {0x1000, 0x7, 0xffff}, {0x137, 0x4, 0x6}, {0x7f, 0x2, 0x1}, {0x8, 0x2, 0x1000}, {0x1, 0xf46, 0xcd}, {0x2, 0xffffffba, 0x1}, {0x2, 0x8, 0x7}, {0x4800, 0x0, 0x400}, {0x6, 0x6, 0x6}, {0x7fff, 0xe89e, 0x40}, {0x2, 0x9, 0x9}]}) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x6) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom1\x00', 0x3, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x81) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x80000000) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f0000000080)={0x6, &(0x7f0000000040)="6f4dd333250287f7a6b64ada2a796f2b2b027ca52af80baeb74ecc75c5fbf72d1cacc0933abe27ec34d26d5c83e857b320994f0a82c9db"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) mremap(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) mmap$usbfs(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x1010, r0, 0x5) (async) syz_open_dev$usbfs(&(0x7f00000000c0), 0xffffffffffffffff, 0xcc000) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000140), 0x800, 0x242) (async) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000280)=@urb_type_iso={0x0, {0x9}, 0x1, 0x84, &(0x7f0000000180)="93e1b7d5148fe064c4a4430441c845788d924283dea12a14497b860ab75d078754ca04c715d72abab1ce508bf2fa9de9f594b467cd469865b3ea5721429a713b351488c0eb5dce2820", 0x49, 0x8, 0x81, 0x7f, 0x7fffffff, 0x3, &(0x7f0000000200)="a1d5496ccc241851dc13bf228ce8565daca35f49c7c5301c877d612e921393094bad8c6538197b11fa98f1777c22b03c1967622989e6e4748c8dad91245dee6c99847619ffa9719c716c1b1512279973e9d5a3a57f9e644ccb7d870dfc7a94f521bd018c8a", [{0x58, 0x8, 0x401}, {0x8001, 0x4, 0x7fff}, {0x52e0, 0x2, 0x6}, {0x0, 0x4, 0x8}, {0x3, 0x2, 0x3}, {0x7f, 0x80, 0x1a}, {0x7, 0xff, 0x3}, {0x4, 0xd6c, 0x20002000}, {0x6442, 0x582, 0x9}, {0xe2, 0x81, 0x5d80}, {0x4, 0x0, 0x6}, {0x5, 0x400, 0x8}, {0x1, 0x2, 0x1}, {0x8, 0x15ca, 0x6126}, {0x1, 0xbc26, 0x6}, {0x0, 0x9, 0xf485}, {0x4, 0xbdf, 0x800}, {0x4, 0x20, 0xffffffde}, {0xb68, 0x8}, {0x335, 0x0, 0x7f}, {0x2, 0x0, 0x1}, {0xeee2, 0x8, 0x9}, {0x800000, 0x10000, 0x9}, {0x1, 0xff, 0x400}, {0x3, 0x6f9a, 0x2400}, {0x1f, 0xffff, 0x3}, {0x1, 0x86c, 0x7b}, {0x1, 0x1000, 0x1}, {0x400, 0x8106, 0xffff8000}, {0x800, 0xa7, 0xffffff7f}, {0x80, 0x48e0, 0x4}, {0x7, 0x10001, 0x7f}, {0x4, 0x8000, 0xca13}, {0x3, 0x1, 0xfffffff9}, {0x5, 0x4, 0x8}, {0x80, 0x2, 0x6}, {0x0, 0x7f, 0x5}, {0x0, 0x8722, 0xfffffffb}, {0xfffffffe, 0x6, 0x7}, {0x1, 0x8000, 0xffff0001}, {0xd96, 0x2, 0x58}, {0x1ff, 0x2, 0x61}, {0x5a, 0xd9be, 0x7}, {0x4, 0x996}, {0x0, 0xa15f, 0x3ff}, {0x3, 0x0, 0x7}, {0xfffffffa, 0x481, 0x113}, {0x3, 0xff, 0x6}, {0x9, 0x7f, 0x3ff}, {0x800, 0x8, 0x8}, {0x85c00000, 0x5, 0x1f}, {0x7, 0x61f, 0xffffffff}, {0x911f37df, 0x4, 0x657c}, {0x800, 0x779, 0x7b2}, {0x7fff, 0x6, 0x6}, {0x401, 0x4, 0x2}, {0x7, 0x5, 0x19}, {0x1ff, 0x3f, 0x81}, {0xec3, 0x341}, {0xff, 0x8, 0x80}, {0x2, 0x9, 0x1}, {0x8000, 0x0, 0x41245ca}, {0x3f, 0x100, 0x1}, {0x9, 0x6, 0x5}, {0x0, 0x2, 0x7}, {0x10000, 0x8, 0x40000003}, {0x1f, 0x8, 0x9}, {0x6, 0x7f, 0x6}, {0x7, 0xa06d, 0x9}, {0x8, 0x2, 0x400}, {0x2ad9, 0x7, 0x80000000}, {0x6e, 0x0, 0x7}, {0x0, 0x9, 0x3}, {0x1ff, 0xc4, 0x7}, {0x0, 0x4, 0xffffffff}, {0x9d, 0xfffffff9, 0x7fffffff}, {0x9, 0x6, 0x3}, {0x3, 0x500, 0x4}, {0x6, 0x6, 0x9}, {0x101, 0x20, 0x5}, {0x9f, 0x3, 0x9}, {0x5, 0xe11, 0x5652cfe6}, {0xc1f00000, 0x9, 0x6}, {0x6, 0x81, 0x6}, {0x5, 0xffff8692, 0x3}, {0x326b59f7, 0x5, 0x9}, {0x3, 0x1}, {0x1, 0x7, 0x5}, {0x6, 0x2, 0x7}, {0x7, 0x1, 0x9}, {0x9, 0xc5b}, {0x2, 0x9, 0x5}, {0x4, 0xf6b, 0xfffffffe}, {0x8, 0x7, 0x5}, {0x8, 0x2}, {0x5, 0x10000, 0x40}, {0x9, 0x9, 0x1}, {0xffff, 0x1, 0x2}, {0x4, 0x5, 0x2}, {0xffffffff, 0x2649, 0x10000}, {0x7, 0x2, 0x3}, {0x7, 0x35, 0x8}, {0x1f, 0x200, 0x40}, {0x30000, 0x101, 0x7}, {0x73f3, 0x80000001}, {0xff, 0x0, 0x40}, {0x80000001, 0xc82, 0x1ff}, {0x4, 0xffff77ca, 0x3}, {0x100, 0x0, 0x2}, {0x0, 0x6, 0x1ff}, {0x7fff, 0x8, 0x1000}, {0x0, 0x7, 0x2}, {0x1, 0x5, 0x800}, {0xfffffffc, 0x6, 0x4}, {0x3, 0x7f, 0x8}, {0x2, 0x7f, 0x3}, {0x1000, 0x7, 0xffff}, {0x137, 0x4, 0x6}, {0x7f, 0x2, 0x1}, {0x8, 0x2, 0x1000}, {0x1, 0xf46, 0xcd}, {0x2, 0xffffffba, 0x1}, {0x2, 0x8, 0x7}, {0x4800, 0x0, 0x400}, {0x6, 0x6, 0x6}, {0x7fff, 0xe89e, 0x40}, {0x2, 0x9, 0x9}]}) (async) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}) (async) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x6) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom1\x00', 0x3, 0x0) (async) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x81) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) (async) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x80000000) (async) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f0000000080)={0x6, &(0x7f0000000040)="6f4dd333250287f7a6b64ada2a796f2b2b027ca52af80baeb74ecc75c5fbf72d1cacc0933abe27ec34d26d5c83e857b320994f0a82c9db"}) (async) 00:11:45 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xd00}, 0x48) 00:11:45 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000, 0x138bd076fb8f3106, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mremap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x2000, 0x138bd076fb8f3106, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:45 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:45 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x557fffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0x1, 0x1, 0x5, 0x8, @vifc_lcl_ifindex=r2, @loopback}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@loopback, @local, 0x1b, 0x4}}) socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0x1, 0x1, 0x5, 0x8, @vifc_lcl_ifindex=r2, @loopback}, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@loopback, @local, 0x1b, 0x4}}) (async) socket$phonet_pipe(0x23, 0x5, 0x2) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) 00:11:45 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = io_uring_setup(0x5bd9, &(0x7f0000000000)={0x0, 0xff58, 0x0, 0x2, 0x10000}) syz_io_uring_setup(0x5962, &(0x7f0000000080)={0x0, 0x7474, 0x0, 0x1, 0x3da, 0x0, r0}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xe00}, 0x48) 00:11:45 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) (async) getsockopt$inet_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:45 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x99030000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x60}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xf00}, 0x48) 00:11:45 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = io_uring_setup(0x5bd9, &(0x7f0000000000)={0x0, 0xff58, 0x0, 0x2, 0x10000}) syz_io_uring_setup(0x5962, &(0x7f0000000080)={0x0, 0x7474, 0x0, 0x1, 0x3da, 0x0, r0}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) io_uring_setup(0x5bd9, &(0x7f0000000000)={0x0, 0xff58, 0x0, 0x2, 0x10000}) (async) syz_io_uring_setup(0x5962, &(0x7f0000000080)={0x0, 0x7474, 0x0, 0x1, 0x3da, 0x0, r0}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) 00:11:45 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x121}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) (async) getsockopt$inet_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:45 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xd8000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r2 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r3, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'erspan0\x00', &(0x7f0000000280)={'tunl0\x00', r3, 0x10, 0x7800, 0x9, 0xb71, {{0x9, 0x4, 0x2, 0x29, 0x24, 0x67, 0x0, 0x7f, 0x2d, 0x0, @private=0xa010100, @empty, {[@timestamp_prespec={0x44, 0xc, 0xd0, 0x3, 0x5, [{@loopback, 0x3}]}, @generic={0x94, 0x2}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000100)={@private2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xd, 0x1b}}) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) r5 = bpf$MAP_CREATE(0x2, &(0x7f0000000040)=@bloom_filter={0x1e, 0x40008c11, 0xc8f4, 0x5, 0x201, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x101, 0x5, 0x9}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r7, 0x541b, &(0x7f0000000240)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r5, 0xc0182101, &(0x7f00000001c0)={r6, 0x2, 0x3ff}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f00000000c0)=r6) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1100}, 0x48) 00:11:45 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = userfaultfd(0x80000) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) ioctl$SNDCTL_SEQ_CTRLRATE(0xffffffffffffffff, 0xc0045103, &(0x7f0000000000)=0x359) 00:11:45 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x300}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1200}, 0x48) 00:11:46 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = io_uring_setup(0x5bd9, &(0x7f0000000000)={0x0, 0xff58, 0x0, 0x2, 0x10000}) syz_io_uring_setup(0x5962, &(0x7f0000000080)={0x0, 0x7474, 0x0, 0x1, 0x3da, 0x0, r0}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) 00:11:46 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = userfaultfd(0x80000) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) (async) ioctl$SNDCTL_SEQ_CTRLRATE(0xffffffffffffffff, 0xc0045103, &(0x7f0000000000)=0x359) 00:11:46 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xda000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1300}, 0x48) 00:11:46 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = userfaultfd(0x80000) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) (async) ioctl$SNDCTL_SEQ_CTRLRATE(0xffffffffffffffff, 0xc0045103, &(0x7f0000000000)=0x359) 00:11:46 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xfeffffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) r1 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r2 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) (async, rerun: 32) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) (rerun: 32) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r3, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'erspan0\x00', &(0x7f0000000280)={'tunl0\x00', r3, 0x10, 0x7800, 0x9, 0xb71, {{0x9, 0x4, 0x2, 0x29, 0x24, 0x67, 0x0, 0x7f, 0x2d, 0x0, @private=0xa010100, @empty, {[@timestamp_prespec={0x44, 0xc, 0xd0, 0x3, 0x5, [{@loopback, 0x3}]}, @generic={0x94, 0x2}]}}}}}) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000100)={@private2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xd, 0x1b}}) (async, rerun: 64) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) (async) r5 = bpf$MAP_CREATE(0x2, &(0x7f0000000040)=@bloom_filter={0x1e, 0x40008c11, 0xc8f4, 0x5, 0x201, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x101, 0x5, 0x9}, 0x48) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, 0x0) (async) ioctl$sock_inet_udp_SIOCINQ(r7, 0x541b, &(0x7f0000000240)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r5, 0xc0182101, &(0x7f00000001c0)={r6, 0x2, 0x3ff}) (async, rerun: 64) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f00000000c0)=r6) (rerun: 64) 00:11:46 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x82401, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x6) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$qrtrtun(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x1010, r0, 0x4) 00:11:46 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1400}, 0x48) 00:11:46 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x700}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) 00:11:46 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xff0f4055}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x82401, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x6) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async, rerun: 32) mmap$qrtrtun(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x1010, r0, 0x4) (rerun: 32) 00:11:46 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1500}, 0x48) 00:11:46 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x900}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) (async) 00:11:46 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xff0f5255}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) r1 = bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) r2 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r3, @multicast2}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'erspan0\x00', &(0x7f0000000280)={'tunl0\x00', r3, 0x10, 0x7800, 0x9, 0xb71, {{0x9, 0x4, 0x2, 0x29, 0x24, 0x67, 0x0, 0x7f, 0x2d, 0x0, @private=0xa010100, @empty, {[@timestamp_prespec={0x44, 0xc, 0xd0, 0x3, 0x5, [{@loopback, 0x3}]}, @generic={0x94, 0x2}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000100)={@private2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xd, 0x1b}}) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) r5 = bpf$MAP_CREATE(0x2, &(0x7f0000000040)=@bloom_filter={0x1e, 0x40008c11, 0xc8f4, 0x5, 0x201, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x101, 0x5, 0x9}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0}) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r7, 0x541b, &(0x7f0000000240)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r5, 0xc0182101, &(0x7f00000001c0)={r6, 0x2, 0x3ff}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f00000000c0)=r6) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) bpf$MAP_CREATE(0x3, &(0x7f0000000040), 0x48) (async) socket$igmp(0x2, 0x3, 0x2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000000c0)}, 0x10) (async) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r3, @multicast2}, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'erspan0\x00', &(0x7f0000000280)={'tunl0\x00', r3, 0x10, 0x7800, 0x9, 0xb71, {{0x9, 0x4, 0x2, 0x29, 0x24, 0x67, 0x0, 0x7f, 0x2d, 0x0, @private=0xa010100, @empty, {[@timestamp_prespec={0x44, 0xc, 0xd0, 0x3, 0x5, [{@loopback, 0x3}]}, @generic={0x94, 0x2}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000100)={@private2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xd, 0x1b}}) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) (async) bpf$MAP_CREATE(0x2, &(0x7f0000000040)=@bloom_filter={0x1e, 0x40008c11, 0xc8f4, 0x5, 0x201, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x101, 0x5, 0x9}, 0x48) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, 0x0) (async) ioctl$sock_inet_udp_SIOCINQ(r7, 0x541b, &(0x7f0000000240)) (async) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r5, 0xc0182101, &(0x7f00000001c0)={r6, 0x2, 0x3ff}) (async) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r4, 0x40082102, &(0x7f00000000c0)=r6) (async) 00:11:46 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1600}, 0x48) 00:11:46 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x82401, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x6) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async, rerun: 64) mmap$qrtrtun(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x1010, r0, 0x4) (rerun: 64) 00:11:46 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) 00:11:46 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1700}, 0x48) 00:11:46 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xff0f6055}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xa00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 0: mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:46 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xc00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0xffff, 0x2011}}) 00:11:46 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1800}, 0x48) 00:11:46 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffafff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x238c42, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x20c1, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) socket$can_raw(0x1d, 0x3, 0x1) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x8700, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x1ff}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x30}}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x20044880}, 0x10008000) mlock2(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x3}) 00:11:46 executing program 0: mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:46 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1900}, 0x48) 00:11:46 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x238c42, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x20c1, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) socket$can_raw(0x1d, 0x3, 0x1) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x8700, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x1ff}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x30}}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x20044880}, 0x10008000) mlock2(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x3}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x238c42, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x20c1, 0x0) (async) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) (async) socket$can_raw(0x1d, 0x3, 0x1) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x8700, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x1ff}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x30}}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x20044880}, 0x10008000) (async) mlock2(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) (async) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x3}) (async) 00:11:46 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffbfff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:46 executing program 0: mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:46 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1a00}, 0x48) 00:11:46 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffff7f55}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0xffff, 0x2011}}) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1b00}, 0x48) 00:11:47 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000fddbdf2505000000050005000100006b4308167480ca6488666f000500050001223b60f205e25430"], 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x20000000) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, r1, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x81}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x460}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44850}, 0x44000041) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r2, 0x10, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x44040}, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:47 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x238c42, 0x0) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x20c1, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) (async) socket$can_raw(0x1d, 0x3, 0x1) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x8700, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, 0x0, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x1ff}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x30}}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x20044880}, 0x10008000) (async) mlock2(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x3}) 00:11:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000fddbdf2505000000050005000100006b4308167480ca6488666f000500050001223b60f205e25430"], 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x20000000) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, r1, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x81}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x460}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44850}, 0x44000041) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r2, 0x10, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x44040}, 0x0) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1c00}, 0x48) 00:11:47 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6000, 0x0, &(0x7f0000ffa000/0x6000)=nil) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) [ 2792.624274][ T3911] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 00:11:47 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffff8000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1d00}, 0x48) 00:11:47 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6000, 0x0, &(0x7f0000ffa000/0x6000)=nil) (async, rerun: 64) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) (rerun: 64) 00:11:47 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0xffff, 0x2011}}) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0xffff, 0x2011}}) (async) 00:11:47 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1e00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1e00}, 0x48) 00:11:47 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xfffffffe}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6000, 0x0, &(0x7f0000ffa000/0x6000)=nil) mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) 00:11:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000fddbdf2505000000050005000100006b4308167480ca6488666f000500050001223b60f205e25430"], 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x20000000) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, r1, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x81}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x460}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44850}, 0x44000041) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r2, 0x10, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x44040}, 0x0) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1f00}, 0x48) 00:11:47 executing program 1: mmap$qrtrtun(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x3000003, 0x110, 0xffffffffffffffff, 0xfffffffffffffffb) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xe000, 0x7, &(0x7f0000ff2000/0xe000)=nil) 00:11:47 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ffc000/0x4000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x4}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x400) [ 2792.919936][ T3948] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 00:11:47 executing program 1: mmap$qrtrtun(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x3000003, 0x110, 0xffffffffffffffff, 0xfffffffffffffffb) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xe000, 0x7, &(0x7f0000ff2000/0xe000)=nil) mmap$qrtrtun(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x3000003, 0x110, 0xffffffffffffffff, 0xfffffffffffffffb) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xe000, 0x7, &(0x7f0000ff2000/0xe000)=nil) (async) 00:11:47 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 3: bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0x1, 0x58, &(0x7f00000000c0)}, 0x10) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@local, @empty, 0x0, 0x8}}) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x2000}, 0x48) 00:11:47 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ffc000/0x4000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x4}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x400) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ffc000/0x4000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x4}) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x400) (async) 00:11:47 executing program 1: mmap$qrtrtun(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x3000003, 0x110, 0xffffffffffffffff, 0xfffffffffffffffb) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xe000, 0x7, &(0x7f0000ff2000/0xe000)=nil) mmap$qrtrtun(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x3000003, 0x110, 0xffffffffffffffff, 0xfffffffffffffffb) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xe000, 0x7, &(0x7f0000ff2000/0xe000)=nil) (async) 00:11:47 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x2100}, 0x48) 00:11:47 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2101}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$usbfs(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3, 0x80010, r0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x392, 0x800) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000040)={0x8, 0x2, "3e9d2e0954f998d8202ca1e555fd8522313f27f09c2e3f14a9cda6281d9874bf7080a99aacb671ee32c67a56ae3939fddcce28f683b06bc2fb5a2017bc57a4ec6a7b554441f9107c0a0fdac6481be1fab77182dd216a104df82fb40571ea5377041855d32d541b2d2cacf5229808f104916a8aa6ef7b7e26f590e3109a6986ca4f6ae333148a7ea0d4e10d168297ab18e53853cd12a8df51aded406a7e5f10358d5ce4b027c02b992ce28f21b332074e6e711dcddc10327df46e972f66a543bdbd63d43dcb4e2fa025ef5515448f9ac57fc5e4365e735dca40f765636e4f95633401ac65ad858fc262a083e99ba9f216bc35792e990c81da6ff7f5b33a471d30"}) 00:11:47 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ffc000/0x4000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x4}) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) (async, rerun: 64) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x400) (rerun: 64) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x2200}, 0x48) 00:11:47 executing program 3: bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0x1, 0x58, &(0x7f00000000c0)}, 0x10) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@local, @empty, 0x0, 0x8}}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0x1, 0x58, &(0x7f00000000c0)}, 0x10) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@local, @empty, 0x0, 0x8}}) (async) 00:11:47 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2400}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$usbfs(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3, 0x80010, r0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x392, 0x800) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000040)={0x8, 0x2, "3e9d2e0954f998d8202ca1e555fd8522313f27f09c2e3f14a9cda6281d9874bf7080a99aacb671ee32c67a56ae3939fddcce28f683b06bc2fb5a2017bc57a4ec6a7b554441f9107c0a0fdac6481be1fab77182dd216a104df82fb40571ea5377041855d32d541b2d2cacf5229808f104916a8aa6ef7b7e26f590e3109a6986ca4f6ae333148a7ea0d4e10d168297ab18e53853cd12a8df51aded406a7e5f10358d5ce4b027c02b992ce28f21b332074e6e711dcddc10327df46e972f66a543bdbd63d43dcb4e2fa025ef5515448f9ac57fc5e4365e735dca40f765636e4f95633401ac65ad858fc262a083e99ba9f216bc35792e990c81da6ff7f5b33a471d30"}) 00:11:47 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x2300}, 0x48) 00:11:47 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2a00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x6}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:47 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x3f00}, 0x48) 00:11:47 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) 00:11:47 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$usbfs(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3, 0x80010, r0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x392, 0x800) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000040)={0x8, 0x2, "3e9d2e0954f998d8202ca1e555fd8522313f27f09c2e3f14a9cda6281d9874bf7080a99aacb671ee32c67a56ae3939fddcce28f683b06bc2fb5a2017bc57a4ec6a7b554441f9107c0a0fdac6481be1fab77182dd216a104df82fb40571ea5377041855d32d541b2d2cacf5229808f104916a8aa6ef7b7e26f590e3109a6986ca4f6ae333148a7ea0d4e10d168297ab18e53853cd12a8df51aded406a7e5f10358d5ce4b027c02b992ce28f21b332074e6e711dcddc10327df46e972f66a543bdbd63d43dcb4e2fa025ef5515448f9ac57fc5e4365e735dca40f765636e4f95633401ac65ad858fc262a083e99ba9f216bc35792e990c81da6ff7f5b33a471d30"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$usbfs(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3, 0x80010, r0, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000000), 0x392, 0x800) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000040)={0x8, 0x2, "3e9d2e0954f998d8202ca1e555fd8522313f27f09c2e3f14a9cda6281d9874bf7080a99aacb671ee32c67a56ae3939fddcce28f683b06bc2fb5a2017bc57a4ec6a7b554441f9107c0a0fdac6481be1fab77182dd216a104df82fb40571ea5377041855d32d541b2d2cacf5229808f104916a8aa6ef7b7e26f590e3109a6986ca4f6ae333148a7ea0d4e10d168297ab18e53853cd12a8df51aded406a7e5f10358d5ce4b027c02b992ce28f21b332074e6e711dcddc10327df46e972f66a543bdbd63d43dcb4e2fa025ef5515448f9ac57fc5e4365e735dca40f765636e4f95633401ac65ad858fc262a083e99ba9f216bc35792e990c81da6ff7f5b33a471d30"}) (async) 00:11:48 executing program 3: bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0x1, 0x58, &(0x7f00000000c0)}, 0x10) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@local, @empty, 0x0, 0x8}}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0x1, 0x58, &(0x7f00000000c0)}, 0x10) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@local, @empty, 0x0, 0x8}}) (async) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x4000}, 0x48) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 0: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) (async) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x6104}, 0x48) 00:11:48 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) 00:11:48 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 0: mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x400000}, 0x48) 00:11:48 executing program 0: mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:11:48 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f00000004c0)=ANY=[]}) socketpair(0xf, 0x3, 0xf74f, &(0x7f00000001c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000080}, 0x4004010) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000000c0)={0x0, 0x2, 0x2}) 00:11:48 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async, rerun: 64) ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404) (rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3c00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 0: mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x80ffff}, 0x48) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x9}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x3, 0x4000, @fd_index=0x6, 0xffffffffcc50ad94, 0x0, 0x0, 0x0, 0x1}, 0x40) epoll_create1(0x0) 00:11:48 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0xffff, &(0x7f0000ffd000/0x3000)=nil, 0x5) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1000000}, 0x48) 00:11:48 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f00000004c0)=ANY=[]}) socketpair(0xf, 0x3, 0xf74f, &(0x7f00000001c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000080}, 0x4004010) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000000c0)={0x0, 0x2, 0x2}) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f00000004c0)=ANY=[]}) (async) socketpair(0xf, 0x3, 0xf74f, &(0x7f00000001c0)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000080}, 0x4004010) (async) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000000c0)={0x0, 0x2, 0x2}) (async) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xa}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0xffff, &(0x7f0000ffd000/0x3000)=nil, 0x5) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0xffff, &(0x7f0000ffd000/0x3000)=nil, 0x5) (async) 00:11:48 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x3, 0x4000, @fd_index=0x6, 0xffffffffcc50ad94, 0x0, 0x0, 0x0, 0x1}, 0x40) epoll_create1(0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (async) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x3, 0x4000, @fd_index=0x6, 0xffffffffcc50ad94, 0x0, 0x0, 0x0, 0x1}, 0x40) (async) epoll_create1(0x0) (async) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x2000000}, 0x48) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f00000004c0)=ANY=[]}) socketpair(0xf, 0x3, 0xf74f, &(0x7f00000001c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000080}, 0x4004010) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000000c0)={0x0, 0x2, 0x2}) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000000)={'gre0\x00', &(0x7f00000004c0)=ANY=[]}) (async) socketpair(0xf, 0x3, 0xf74f, &(0x7f00000001c0)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x54, 0x0, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000080}, 0x4004010) (async) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000000c0)={0x0, 0x2, 0x2}) (async) 00:11:48 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0xffff, &(0x7f0000ffd000/0x3000)=nil, 0x5) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0xffff, &(0x7f0000ffd000/0x3000)=nil, 0x5) (async) 00:11:48 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xc}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x3000000}, 0x48) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x6000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async) syz_io_uring_submit(0x0, r1, &(0x7f0000000000)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x3, 0x4000, @fd_index=0x6, 0xffffffffcc50ad94, 0x0, 0x0, 0x0, 0x1}, 0x40) epoll_create1(0x0) 00:11:48 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r0, 0x80045105, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) 00:11:48 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x0, 0x504002) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f0000000040)={0x7, 0x1}) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000080)={0x9, 0x8}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000200)=@urb_type_control={0x2, {0xe}, 0x800, 0x0, &(0x7f00000000c0)={0x5, 0x9, 0x4, 0x0, 0x5}, 0x8, 0x8, 0x1, 0x0, 0x40, 0x3, &(0x7f0000000100)="9581947744206f010360bd0a7488c08f1077669720c266f6be142cd406fe3930733bd31d287d5141ea8d0b50afd9f8891db12f02214708dd20e5b7a8f6a584256f16e4ace36083c5aaf802ee830efe28b5b85eb607820935e7ef8acc79d7235caa139efdbd195bb0de7257007759e5c80ff1bada765a90e29505b28075dbc9565cc432c8bf632b497dc51decd6389ed23c2a8a4cc837d33b526f8b2fa9d49d8d0d4301961a73676c2f9ef985e1f64ba98e277805042cf1ce2a545d4a4c50938c27ad65d584d7ae5a938c4a0c33ad20cd1055fb57fc5b3af5736ef0a26a5356f9271ac70fd0455f9f48edf767faafdb5675fceb8042c9ca"}) r1 = syz_open_dev$usbfs(&(0x7f0000000240), 0x40, 0x20000) ioctl$USBDEVFS_CONNECTINFO(r1, 0x40085511, &(0x7f0000000280)) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x4000000}, 0x48) 00:11:48 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x5000000}, 0x48) 00:11:48 executing program 1: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x440400, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0xffffffffffffff60, 0x2300) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000000)=0x410001) 00:11:48 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x10}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x0, 0x504002) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f0000000040)={0x7, 0x1}) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000080)={0x9, 0x8}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000200)=@urb_type_control={0x2, {0xe}, 0x800, 0x0, &(0x7f00000000c0)={0x5, 0x9, 0x4, 0x0, 0x5}, 0x8, 0x8, 0x1, 0x0, 0x40, 0x3, &(0x7f0000000100)="9581947744206f010360bd0a7488c08f1077669720c266f6be142cd406fe3930733bd31d287d5141ea8d0b50afd9f8891db12f02214708dd20e5b7a8f6a584256f16e4ace36083c5aaf802ee830efe28b5b85eb607820935e7ef8acc79d7235caa139efdbd195bb0de7257007759e5c80ff1bada765a90e29505b28075dbc9565cc432c8bf632b497dc51decd6389ed23c2a8a4cc837d33b526f8b2fa9d49d8d0d4301961a73676c2f9ef985e1f64ba98e277805042cf1ce2a545d4a4c50938c27ad65d584d7ae5a938c4a0c33ad20cd1055fb57fc5b3af5736ef0a26a5356f9271ac70fd0455f9f48edf767faafdb5675fceb8042c9ca"}) r1 = syz_open_dev$usbfs(&(0x7f0000000240), 0x40, 0x20000) ioctl$USBDEVFS_CONNECTINFO(r1, 0x40085511, &(0x7f0000000280)) syz_open_dev$usbfs(&(0x7f0000000000), 0x0, 0x504002) (async) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f0000000040)={0x7, 0x1}) (async) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000080)={0x9, 0x8}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000200)=@urb_type_control={0x2, {0xe}, 0x800, 0x0, &(0x7f00000000c0)={0x5, 0x9, 0x4, 0x0, 0x5}, 0x8, 0x8, 0x1, 0x0, 0x40, 0x3, &(0x7f0000000100)="9581947744206f010360bd0a7488c08f1077669720c266f6be142cd406fe3930733bd31d287d5141ea8d0b50afd9f8891db12f02214708dd20e5b7a8f6a584256f16e4ace36083c5aaf802ee830efe28b5b85eb607820935e7ef8acc79d7235caa139efdbd195bb0de7257007759e5c80ff1bada765a90e29505b28075dbc9565cc432c8bf632b497dc51decd6389ed23c2a8a4cc837d33b526f8b2fa9d49d8d0d4301961a73676c2f9ef985e1f64ba98e277805042cf1ce2a545d4a4c50938c27ad65d584d7ae5a938c4a0c33ad20cd1055fb57fc5b3af5736ef0a26a5356f9271ac70fd0455f9f48edf767faafdb5675fceb8042c9ca"}) (async) syz_open_dev$usbfs(&(0x7f0000000240), 0x40, 0x20000) (async) ioctl$USBDEVFS_CONNECTINFO(r1, 0x40085511, &(0x7f0000000280)) (async) 00:11:48 executing program 1: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x440400, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0xffffffffffffff60, 0x2300) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000000)=0x410001) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x440400, 0x0) (async) syz_open_dev$usbfs(&(0x7f0000000040), 0xffffffffffffff60, 0x2300) (async) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000000)=0x410001) (async) 00:11:48 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x400000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:48 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x6000000}, 0x48) 00:11:49 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r0, 0x80045105, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x12}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 1: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x440400, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0xffffffffffffff60, 0x2300) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000000)=0x410001) 00:11:49 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x0, 0x504002) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f0000000040)={0x7, 0x1}) (async) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000080)={0x9, 0x8}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000200)=@urb_type_control={0x2, {0xe}, 0x800, 0x0, &(0x7f00000000c0)={0x5, 0x9, 0x4, 0x0, 0x5}, 0x8, 0x8, 0x1, 0x0, 0x40, 0x3, &(0x7f0000000100)="9581947744206f010360bd0a7488c08f1077669720c266f6be142cd406fe3930733bd31d287d5141ea8d0b50afd9f8891db12f02214708dd20e5b7a8f6a584256f16e4ace36083c5aaf802ee830efe28b5b85eb607820935e7ef8acc79d7235caa139efdbd195bb0de7257007759e5c80ff1bada765a90e29505b28075dbc9565cc432c8bf632b497dc51decd6389ed23c2a8a4cc837d33b526f8b2fa9d49d8d0d4301961a73676c2f9ef985e1f64ba98e277805042cf1ce2a545d4a4c50938c27ad65d584d7ae5a938c4a0c33ad20cd1055fb57fc5b3af5736ef0a26a5356f9271ac70fd0455f9f48edf767faafdb5675fceb8042c9ca"}) r1 = syz_open_dev$usbfs(&(0x7f0000000240), 0x40, 0x20000) ioctl$USBDEVFS_CONNECTINFO(r1, 0x40085511, &(0x7f0000000280)) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x600000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x7000000}, 0x48) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x8000000}, 0x48) 00:11:49 executing program 0: mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x18}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x80ffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 1: syz_io_uring_setup(0x6, &(0x7f0000000040)={0x0, 0x0, 0x900}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x28, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x180000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x58}, 0x1, 0x0, 0x0, 0x20004880}, 0x20044840) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:49 executing program 0: mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) 00:11:49 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r0, 0x80045105, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_GETINCOUNT(r0, 0x80045105, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) (async) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xb0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1e}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 1: syz_io_uring_setup(0x6, &(0x7f0000000040)={0x0, 0x0, 0x900}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x28, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x180000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x58}, 0x1, 0x0, 0x0, 0x20004880}, 0x20044840) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6, &(0x7f0000000040)={0x0, 0x0, 0x900}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan1\x00'}) (async) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x28, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x180000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x28}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan3\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00'}) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x58}, 0x1, 0x0, 0x0, 0x20004880}, 0x20044840) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x9000000}, 0x48) 00:11:49 executing program 0: mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) 00:11:49 executing program 0: r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffe000/0x2000)=nil) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@mcast1, @private0={0xfc, 0x0, '\x00', 0x1}}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xa000000}, 0x48) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x24}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xc0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xb000000}, 0x48) 00:11:49 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x50000, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f00000000c0)={"6bbfab9476a95cfae75786aed0503f775fa07a31d83ce93a00", 0x5, 0xaa78, 0xff, [0x654, 0x842f, 0x1ff, 0x40, 0x4, 0x6, 0xfffffc01, 0x0, 0x3ff, 0x3, 0x6, 0x101, 0xffff, 0x80000000, 0x0, 0x9, 0x6]}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:49 executing program 1: syz_io_uring_setup(0x6, &(0x7f0000000040)={0x0, 0x0, 0x900}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x28, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x180000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan3\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x58}, 0x1, 0x0, 0x0, 0x20004880}, 0x20044840) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:49 executing program 0: r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffe000/0x2000)=nil) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@mcast1, @private0={0xfc, 0x0, '\x00', 0x1}}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) socket$igmp(0x2, 0x3, 0x2) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) (async) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffe000/0x2000)=nil) (async) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@mcast1, @private0={0xfc, 0x0, '\x00', 0x1}}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (async) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2a}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xc000000}, 0x48) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 0: r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffe000/0x2000)=nil) (async) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@mcast1, @private0={0xfc, 0x0, '\x00', 0x1}}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x30}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 1: ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x181880, 0x0) r1 = bpf$MAP_CREATE(0x3, &(0x7f0000000040)=@base={0x6, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x20}, 0x48) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000240)={'gretap0\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x40, 0x20, 0x5, 0x8, {{0x1a, 0x4, 0x0, 0x9, 0x68, 0x68, 0x0, 0x7, 0x29, 0x0, @broadcast, @multicast1, {[@generic={0x82, 0x9, "809cf4dcb7537c"}, @timestamp_prespec={0x44, 0x14, 0x58, 0x3, 0x6, [{@empty, 0x3f}, {@multicast1, 0x80000000}]}, @ra={0x94, 0x4, 0x1}, @generic={0x44, 0x8, "8ff5db689ee8"}, @timestamp_prespec={0x44, 0xc, 0xaf, 0x3, 0x2, [{@empty, 0x3}]}, @end, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0xb, 0xd, [@broadcast, @multicast2]}, @rr={0x7, 0xb, 0x61, [@empty, @empty]}, @noop]}}}}}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x5, 0x9754, 0x1ff, 0x100, r0, 0xfffffffe, '\x00', 0x0, r2, 0x0, 0x5, 0x3}, 0x48) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000040)={0x0, 0x4, 0x1, 0x7, @vifc_lcl_ifindex=r4, @empty}, 0x10) mmap$qrtrtun(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000006, 0x8010, 0xffffffffffffffff, 0x9) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xd000000}, 0x48) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xe000000}, 0x48) 00:11:49 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x50000, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f00000000c0)={"6bbfab9476a95cfae75786aed0503f775fa07a31d83ce93a00", 0x5, 0xaa78, 0xff, [0x654, 0x842f, 0x1ff, 0x40, 0x4, 0x6, 0xfffffc01, 0x0, 0x3ff, 0x3, 0x6, 0x101, 0xffff, 0x80000000, 0x0, 0x9, 0x6]}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) socket$inet_udp(0x2, 0x2, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x50000, 0x0) (async) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f00000000c0)={"6bbfab9476a95cfae75786aed0503f775fa07a31d83ce93a00", 0x5, 0xaa78, 0xff, [0x654, 0x842f, 0x1ff, 0x40, 0x4, 0x6, 0xfffffc01, 0x0, 0x3ff, 0x3, 0x6, 0x101, 0xffff, 0x80000000, 0x0, 0x9, 0x6]}) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) (async) 00:11:49 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x5, 0x4, @vifc_lcl_addr=@multicast2, @multicast1}, 0x10) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x36}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 1: ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x181880, 0x0) (async) r1 = bpf$MAP_CREATE(0x3, &(0x7f0000000040)=@base={0x6, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x20}, 0x48) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000240)={'gretap0\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x40, 0x20, 0x5, 0x8, {{0x1a, 0x4, 0x0, 0x9, 0x68, 0x68, 0x0, 0x7, 0x29, 0x0, @broadcast, @multicast1, {[@generic={0x82, 0x9, "809cf4dcb7537c"}, @timestamp_prespec={0x44, 0x14, 0x58, 0x3, 0x6, [{@empty, 0x3f}, {@multicast1, 0x80000000}]}, @ra={0x94, 0x4, 0x1}, @generic={0x44, 0x8, "8ff5db689ee8"}, @timestamp_prespec={0x44, 0xc, 0xaf, 0x3, 0x2, [{@empty, 0x3}]}, @end, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0xb, 0xd, [@broadcast, @multicast2]}, @rr={0x7, 0xb, 0x61, [@empty, @empty]}, @noop]}}}}}) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x5, 0x9754, 0x1ff, 0x100, r0, 0xfffffffe, '\x00', 0x0, r2, 0x0, 0x5, 0x3}, 0x48) (async) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) (async) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000040)={0x0, 0x4, 0x1, 0x7, @vifc_lcl_ifindex=r4, @empty}, 0x10) (async) mmap$qrtrtun(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000006, 0x8010, 0xffffffffffffffff, 0x9) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xf000000}, 0x48) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x5, 0x4, @vifc_lcl_addr=@multicast2, @multicast1}, 0x10) 00:11:49 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x10000000}, 0x48) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3c}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 1: ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)) (async, rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 64) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x181880, 0x0) (async) r1 = bpf$MAP_CREATE(0x3, &(0x7f0000000040)=@base={0x6, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x20}, 0x48) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000240)={'gretap0\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x40, 0x20, 0x5, 0x8, {{0x1a, 0x4, 0x0, 0x9, 0x68, 0x68, 0x0, 0x7, 0x29, 0x0, @broadcast, @multicast1, {[@generic={0x82, 0x9, "809cf4dcb7537c"}, @timestamp_prespec={0x44, 0x14, 0x58, 0x3, 0x6, [{@empty, 0x3f}, {@multicast1, 0x80000000}]}, @ra={0x94, 0x4, 0x1}, @generic={0x44, 0x8, "8ff5db689ee8"}, @timestamp_prespec={0x44, 0xc, 0xaf, 0x3, 0x2, [{@empty, 0x3}]}, @end, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0xb, 0xd, [@broadcast, @multicast2]}, @rr={0x7, 0xb, 0x61, [@empty, @empty]}, @noop]}}}}}) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) (async, rerun: 64) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x5, 0x9754, 0x1ff, 0x100, r0, 0xfffffffe, '\x00', 0x0, r2, 0x0, 0x5, 0x3}, 0x48) (rerun: 64) r3 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r3) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x1, 0x1, 0x7, 0x8, @vifc_lcl_ifindex=r4, @multicast2}, 0x10) (async) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000040)={0x0, 0x4, 0x1, 0x7, @vifc_lcl_ifindex=r4, @empty}, 0x10) (async, rerun: 64) mmap$qrtrtun(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000006, 0x8010, 0xffffffffffffffff, 0x9) (rerun: 64) 00:11:49 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x6000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:49 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x50000, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f00000000c0)={"6bbfab9476a95cfae75786aed0503f775fa07a31d83ce93a00", 0x5, 0xaa78, 0xff, [0x654, 0x842f, 0x1ff, 0x40, 0x4, 0x6, 0xfffffc01, 0x0, 0x3ff, 0x3, 0x6, 0x101, 0xffff, 0x80000000, 0x0, 0x9, 0x6]}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:49 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3d}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x5, 0x4, @vifc_lcl_addr=@multicast2, @multicast1}, 0x10) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x7000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x11000000}, 0x48) 00:11:50 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x7549, &(0x7f0000000100)={0x0, 0xea8, 0x2, 0x2, 0x1c6}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x8000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x12000000}, 0x48) 00:11:50 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_WRITE={0x17, 0x2, 0x4007, @fd=r0, 0x8, &(0x7f0000000000)="0e1aadb82671a30c06377f8c48c9b0a9cb015dfe2b39b0d8c4b38c7eb2168e8d0b39d8b57191bef3a11a775eb67b396bb69110ba8acec240b64317a432b75b6f0140d16335697ae65bc3210b5963ed337103ee050b782edc4ab0adbcab3c503268a81ad0e1eec7566ca6f1115f3ab61304a6dce25be682d16c41629076d440e616999b0cef40aa6b5e0a9df4c7fe6ed5f453c00ccd9e736cabeb353b5eadc5fcd2537508d0d9", 0xa6, 0x7}, 0x4) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x9000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_io_uring_setup(0x7549, &(0x7f0000000100)={0x0, 0xea8, 0x2, 0x2, 0x1c6}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 00:11:50 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x6, 0x0, 0x40}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:50 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_WRITE={0x17, 0x2, 0x4007, @fd=r0, 0x8, &(0x7f0000000000)="0e1aadb82671a30c06377f8c48c9b0a9cb015dfe2b39b0d8c4b38c7eb2168e8d0b39d8b57191bef3a11a775eb67b396bb69110ba8acec240b64317a432b75b6f0140d16335697ae65bc3210b5963ed337103ee050b782edc4ab0adbcab3c503268a81ad0e1eec7566ca6f1115f3ab61304a6dce25be682d16c41629076d440e616999b0cef40aa6b5e0a9df4c7fe6ed5f453c00ccd9e736cabeb353b5eadc5fcd2537508d0d9", 0xa6, 0x7}, 0x4) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x13000000}, 0x48) 00:11:50 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x60}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xa000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_WRITE={0x17, 0x2, 0x4007, @fd=r0, 0x8, &(0x7f0000000000)="0e1aadb82671a30c06377f8c48c9b0a9cb015dfe2b39b0d8c4b38c7eb2168e8d0b39d8b57191bef3a11a775eb67b396bb69110ba8acec240b64317a432b75b6f0140d16335697ae65bc3210b5963ed337103ee050b782edc4ab0adbcab3c503268a81ad0e1eec7566ca6f1115f3ab61304a6dce25be682d16c41629076d440e616999b0cef40aa6b5e0a9df4c7fe6ed5f453c00ccd9e736cabeb353b5eadc5fcd2537508d0d9", 0xa6, 0x7}, 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_WRITE={0x17, 0x2, 0x4007, @fd=r0, 0x8, &(0x7f0000000000)="0e1aadb82671a30c06377f8c48c9b0a9cb015dfe2b39b0d8c4b38c7eb2168e8d0b39d8b57191bef3a11a775eb67b396bb69110ba8acec240b64317a432b75b6f0140d16335697ae65bc3210b5963ed337103ee050b782edc4ab0adbcab3c503268a81ad0e1eec7566ca6f1115f3ab61304a6dce25be682d16c41629076d440e616999b0cef40aa6b5e0a9df4c7fe6ed5f453c00ccd9e736cabeb353b5eadc5fcd2537508d0d9", 0xa6, 0x7}, 0x4) (async) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x14000000}, 0x48) 00:11:50 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x7549, &(0x7f0000000100)={0x0, 0xea8, 0x2, 0x2, 0x1c6}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_io_uring_setup(0x7549, &(0x7f0000000100)={0x0, 0xea8, 0x2, 0x2, 0x1c6}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) 00:11:50 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xc000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x15000000}, 0x48) 00:11:50 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xda}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x6, 0x0, 0x40}) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:50 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f0000ffa000/0x3000)=nil) 00:11:50 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x100010, 0xffffffffffffffff, 0x0) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x16000000}, 0x48) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x121}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x100010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x100010, 0xffffffffffffffff, 0x0) (async) 00:11:50 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f0000ffa000/0x3000)=nil) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x10000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x300}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x17000000}, 0x48) 00:11:50 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$usbfs(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x100010, 0xffffffffffffffff, 0x0) 00:11:50 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x4000)=nil, 0x6, 0x0, 0x40}) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:50 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f0000ffa000/0x3000)=nil) 00:11:50 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x324}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x18000000}, 0x48) 00:11:50 executing program 1: mmap$dsp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3800002, 0x80010, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x800, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x5, 0x2, 0x1ff, 0x9d3}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8091}, 0x20000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x12000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x19000000}, 0x48) 00:11:50 executing program 1: mmap$dsp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3800002, 0x80010, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x800, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x5, 0x2, 0x1ff, 0x9d3}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8091}, 0x20000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:50 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x18000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x20000800) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:50 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:50 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1a000000}, 0x48) 00:11:51 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1e000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x20000800) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:51 executing program 1: mmap$dsp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3800002, 0x80010, 0xffffffffffffffff, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async, rerun: 64) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async, rerun: 64) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x800, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x5, 0x2, 0x1ff, 0x9d3}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8091}, 0x20000) (async, rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (rerun: 64) 00:11:51 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x339}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1b000000}, 0x48) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1c000000}, 0x48) 00:11:51 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x399}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x20000800) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1d000000}, 0x48) 00:11:51 executing program 1: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x20010, 0xffffffffffffffff, 0xfffffffffffffffe) 00:11:51 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 0: ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f0000000040)) mremap(&(0x7f0000ff0000/0x4000)=nil, 0x4000, 0x4000, 0x4, &(0x7f0000ffa000/0x4000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa, 0x13, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x2000)=nil, 0x6, 0x4, 0xc8}) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ff3000/0x3000)=nil, 0x3000}) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1e000000}, 0x48) 00:11:51 executing program 1: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) (async) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x20010, 0xffffffffffffffff, 0xfffffffffffffffe) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20ffafff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 0: ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f0000000040)) mremap(&(0x7f0000ff0000/0x4000)=nil, 0x4000, 0x4000, 0x4, &(0x7f0000ffa000/0x4000)=nil) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa, 0x13, 0xffffffffffffffff, 0x0) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x2000)=nil, 0x6, 0x4, 0xc8}) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ff3000/0x3000)=nil, 0x3000}) 00:11:51 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x700}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x1f000000}, 0x48) 00:11:51 executing program 1: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) (async) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x20010, 0xffffffffffffffff, 0xfffffffffffffffe) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20ffb000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:11:51 executing program 0: ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f0000000040)) mremap(&(0x7f0000ff0000/0x4000)=nil, 0x4000, 0x4000, 0x4, &(0x7f0000ffa000/0x4000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa, 0x13, 0xffffffffffffffff, 0x0) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x2000)=nil, 0x6, 0x4, 0xc8}) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ff3000/0x3000)=nil, 0x3000}) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x20000000}, 0x48) 00:11:51 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x900}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20ffbfff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x882}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x0, @media='ib\x00'}}}, ["", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x40004884) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ff9000/0x1000)=nil) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x21000000}, 0x48) 00:11:51 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r2, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r2, 0x4, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x40}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20050841) 00:11:51 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xa00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20ffc000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x882}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x0, @media='ib\x00'}}}, ["", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x40004884) (async) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ff9000/0x1000)=nil) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x22000000}, 0x48) 00:11:51 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x1, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback}}) 00:11:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x882}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x0, @media='ib\x00'}}}, ["", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x40004884) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ff9000/0x1000)=nil) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x882}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, 0x0, 0x8, 0x70bd28, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x0, @media='ib\x00'}}}, ["", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x40004884) (async) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x0) (async) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ff9000/0x1000)=nil) (async) 00:11:51 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xc00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r2, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r2, 0x4, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x40}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20050841) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r2, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r2, 0x4, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x40}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20050841) (async) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x21010000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x23000000}, 0x48) 00:11:51 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x3f000000}, 0x48) 00:11:51 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x24000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:51 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r2, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r2, 0x4, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x8, 0x2, 0x40}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20050841) 00:11:52 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ffc000/0x3000)=nil, 0x3000) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x61040000}, 0x48) 00:11:52 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x1, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x1) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback}}) 00:11:52 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2a000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x40010, 0xffffffffffffffff, 0x0) 00:11:52 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ffc000/0x3000)=nil, 0x3000) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) munlock(&(0x7f0000ffc000/0x3000)=nil, 0x3000) (async) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xe4ffffff}, 0x48) 00:11:52 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x40010, 0xffffffffffffffff, 0x0) 00:11:52 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) munlock(&(0x7f0000ffc000/0x3000)=nil, 0x3000) 00:11:52 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x30000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xffff8000}, 0x48) 00:11:52 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x40010, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x40010, 0xffffffffffffffff, 0x0) (async) 00:11:52 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x36000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000000)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x1, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback}}) 00:11:52 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_io_uring_setup(0x432a, &(0x7f0000000040)={0x0, 0xe9c6, 0x10, 0x0, 0x207, 0x0, r0}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0xffffffe4}, 0x48) 00:11:52 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1e00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x6}) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:11:52 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3c000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x6}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x6}) (async) 00:11:52 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_io_uring_setup(0x432a, &(0x7f0000000040)={0x0, 0xe9c6, 0x10, 0x0, 0x207, 0x0, r0}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) syz_io_uring_setup(0x432a, &(0x7f0000000040)={0x0, 0xe9c6, 0x10, 0x0, 0x207, 0x0, r0}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) (async) 00:11:52 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2}, 0x48) 00:11:52 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x6}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x6}) (async) 00:11:52 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_io_uring_setup(0x432a, &(0x7f0000000040)={0x0, 0xe9c6, 0x10, 0x0, 0x207, 0x0, r0}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) 00:11:52 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x40000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x3}, 0x48) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x4}, 0x48) 00:11:52 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x0, 0x3, 0x6, 0x200, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x2, 0x2}, 0x48) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000000)="5debdd4e2945e9e5d3f4a4433f98733cfcfe830768a0cf6af753c56c5d8746ad56af78d13ffd878abbb10d8bdec1262e603fde86be743b9ecdc1dff85e3fe027918d0dd1cd2b194f", &(0x7f0000000080)=@udp6=r1, 0x2}, 0x20) 00:11:52 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x42000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x40001) mmap$qrtrtun(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0xe, 0x80010, r0, 0x7) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) syz_io_uring_setup(0x4a7c, &(0x7f0000000080)={0x0, 0x7ce4, 0x0, 0x1, 0x30, 0x0, r1}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) setsockopt$MRT_TABLE(r2, 0x0, 0xcf, &(0x7f0000000040), 0x4) 00:11:52 executing program 3: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x20010, 0xffffffffffffffff, 0xfffffffffffffffe) 00:11:52 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2101}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x5}, 0x48) 00:11:52 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x40001) mmap$qrtrtun(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0xe, 0x80010, r0, 0x7) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async, rerun: 64) syz_io_uring_setup(0x4a7c, &(0x7f0000000080)={0x0, 0x7ce4, 0x0, 0x1, 0x30, 0x0, r1}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async, rerun: 64) socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) setsockopt$MRT_TABLE(r2, 0x0, 0xcf, &(0x7f0000000040), 0x4) 00:11:52 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4b000fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x0, 0x3, 0x6, 0x200, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x2, 0x2}, 0x48) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000000)="5debdd4e2945e9e5d3f4a4433f98733cfcfe830768a0cf6af753c56c5d8746ad56af78d13ffd878abbb10d8bdec1262e603fde86be743b9ecdc1dff85e3fe027918d0dd1cd2b194f", &(0x7f0000000080)=@udp6=r1, 0x2}, 0x20) 00:11:52 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2400}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:52 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6}, 0x48) 00:11:52 executing program 3: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x20010, 0xffffffffffffffff, 0xfffffffffffffffe) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2403}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x0, 0x3, 0x6, 0x200, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x2, 0x2}, 0x48) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000000)="5debdd4e2945e9e5d3f4a4433f98733cfcfe830768a0cf6af753c56c5d8746ad56af78d13ffd878abbb10d8bdec1262e603fde86be743b9ecdc1dff85e3fe027918d0dd1cd2b194f", &(0x7f0000000080)=@udp6=r1, 0x2}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x0, 0x3, 0x6, 0x200, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x2, 0x2}, 0x48) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000000)="5debdd4e2945e9e5d3f4a4433f98733cfcfe830768a0cf6af753c56c5d8746ad56af78d13ffd878abbb10d8bdec1262e603fde86be743b9ecdc1dff85e3fe027918d0dd1cd2b194f", &(0x7f0000000080)=@udp6=r1, 0x2}, 0x20) (async) 00:11:53 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4b120fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x7}, 0x48) 00:11:53 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x56e00fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2603}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x40001) mmap$qrtrtun(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0xe, 0x80010, r0, 0x7) (async, rerun: 32) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (rerun: 32) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) (async) syz_io_uring_setup(0x4a7c, &(0x7f0000000080)={0x0, 0x7ce4, 0x0, 0x1, 0x30, 0x0, r1}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000140)) socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r2) (async) setsockopt$MRT_TABLE(r2, 0x0, 0xcf, &(0x7f0000000040), 0x4) 00:11:53 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$qrtrtun(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000001, 0x110, 0xffffffffffffffff, 0x7) 00:11:53 executing program 3: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) mmap$qrtrtun(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x20010, 0xffffffffffffffff, 0xfffffffffffffffe) 00:11:53 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x56ffffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x8}, 0x48) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2a00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xfeffffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$qrtrtun(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000001, 0x110, 0xffffffffffffffff, 0x7) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$qrtrtun(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000001, 0x110, 0xffffffffffffffff, 0x7) (async) 00:11:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x9}, 0x48) 00:11:53 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xff0f004b}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 3: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:53 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$binder(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0xfffffffffffffff7) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x2000)=nil, 0x9, 0x3, 0x8}) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x8010, r0, 0x0) 00:11:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xa}, 0x48) 00:11:53 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$qrtrtun(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000001, 0x110, 0xffffffffffffffff, 0x7) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$qrtrtun(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000001, 0x110, 0xffffffffffffffff, 0x7) (async) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xff0f124b}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 0: mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8000, 0x4, &(0x7f0000ff8000/0x8000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) 00:11:53 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$binder(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0xfffffffffffffff7) (async) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x2000)=nil, 0x9, 0x3, 0x8}) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x8010, r0, 0x0) 00:11:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xb}, 0x48) 00:11:53 executing program 3: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, 0xffffffffffffffff, 0x0) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3903}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 0: mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8000, 0x4, &(0x7f0000ff8000/0x8000)=nil) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) 00:11:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xc}, 0x48) 00:11:53 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$binder(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0xfffffffffffffff7) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x2000)=nil, 0x9, 0x3, 0x8}) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x8010, r0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$binder(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0xfffffffffffffff7) (async) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x2000)=nil, 0x9, 0x3, 0x8}) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x8010, r0, 0x0) (async) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3c00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 3: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, 0xffffffffffffffff, 0x0) 00:11:53 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xff0fe056}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 0: mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8000, 0x4, &(0x7f0000ff8000/0x8000)=nil) (async, rerun: 64) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) (rerun: 64) 00:11:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xd}, 0x48) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3d00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = socket(0x2b, 0xa, 0x200) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x88010003}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x4000) ioctl$USBDEVFS_DISCSIGNAL(r0, 0x8010550e, &(0x7f0000000140)={0x7, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xb, 0x10, r0, 0x0) 00:11:53 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xffafff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:53 executing program 3: syz_io_uring_setup(0x596f, &(0x7f0000000100)={0x0, 0xa6c3, 0x0, 0x0, 0x172}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, 0xffffffffffffffff, 0x0) 00:11:53 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xe}, 0x48) 00:11:53 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000040)={0x3e8, 0x7, [{0x3, 0x1}, {0xe}, {0xc, 0x1}, {0xe, 0x1}, {0x7, 0x1}, {0xc, 0x1}, {0xb, 0x1}]}) 00:11:53 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) r1 = socket(0x2b, 0xa, 0x200) (async) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x88010003}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x4000) ioctl$USBDEVFS_DISCSIGNAL(r0, 0x8010550e, &(0x7f0000000140)={0x7, 0x0}) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xb, 0x10, r0, 0x0) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xffbfff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xf}, 0x48) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) r1 = socket(0x2b, 0xa, 0x200) (async, rerun: 32) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), r0) (rerun: 32) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x88010003}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x4000) ioctl$USBDEVFS_DISCSIGNAL(r0, 0x8010550e, &(0x7f0000000140)={0x7, 0x0}) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xb, 0x10, r0, 0x0) (rerun: 64) 00:11:54 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000040)={0x3e8, 0x7, [{0x3, 0x1}, {0xe}, {0xc, 0x1}, {0xe, 0x1}, {0x7, 0x1}, {0xc, 0x1}, {0xb, 0x1}]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000040)={0x3e8, 0x7, [{0x3, 0x1}, {0xe}, {0xc, 0x1}, {0xe, 0x1}, {0x7, 0x1}, {0xc, 0x1}, {0xb, 0x1}]}) (async) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xffff8000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x10}, 0x48) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xffffff56}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000040)={0x3e8, 0x7, [{0x3, 0x1}, {0xe}, {0xc, 0x1}, {0xe, 0x1}, {0x7, 0x1}, {0xc, 0x1}, {0xb, 0x1}]}) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x11}, 0x48) 00:11:54 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6cde, &(0x7f0000000000)={0x0, 0x7940, 0x4, 0x3, 0x330}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITEV={0x2, 0x3, 0x2000, @fd, 0x9, &(0x7f0000000340)=[{&(0x7f0000000100)="3e51b68770578f2ea4b8a7d6aea1e4c781ce420afa27", 0x16}, {&(0x7f0000000140)="740de3898eb95a5c73e068e5144a9b75bf304283df8c6acb21d5b3d1fd1439793e2333e87ea6eaa5db84ba6db4114fe3190517a1a9034db14334834347948e137bf69c3063368231f6f0066ec35d460603d7ece6586e332b797755c0d63901de30e91f07819cd24371c60e9e81d065d694e1e7202d4a25427c91b83ab8e1038e8fd33d561850cfed5fc11e7644576e1c54a13ff095db1086862192eea13d2d0568101b984911837066dc7f957cb39f10a6568248c507a5321f97a6448304c37c54c61b26d7144a90f08ae97bbb59caf1a12e261014347a", 0xd7}, {&(0x7f0000000240)="08ed79a2c0817af47854f130cbead2027b4ea85d8725d1ea93ec9c28b0fab96e547dd82b46e0ce7836636b1431ca32430d315dbc0f2b5f10a5cb688f4f95bb1d130dfd", 0x43}, {&(0x7f00000002c0)="c6df66ec9739c568cacf878da37cab8423d4d3ebca7a03bc79c64e7f5e2d8631f401e30f2b854c7ac1374c8de03f438e5834e6698e3c88d3634064fb7cd201a7a6611296b8a3440417f8d869189408546fe7f2b9a502f31588fd52219f9dec25cc1e52ba4abdc0f523e4af99c2274704f0958cb6d5f00e2cb541", 0x7a}], 0x4, 0x8, 0x1, {0x2}}, 0x6) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x6000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xfffffffe}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6cde, &(0x7f0000000000)={0x0, 0x7940, 0x4, 0x3, 0x330}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITEV={0x2, 0x3, 0x2000, @fd, 0x9, &(0x7f0000000340)=[{&(0x7f0000000100)="3e51b68770578f2ea4b8a7d6aea1e4c781ce420afa27", 0x16}, {&(0x7f0000000140)="740de3898eb95a5c73e068e5144a9b75bf304283df8c6acb21d5b3d1fd1439793e2333e87ea6eaa5db84ba6db4114fe3190517a1a9034db14334834347948e137bf69c3063368231f6f0066ec35d460603d7ece6586e332b797755c0d63901de30e91f07819cd24371c60e9e81d065d694e1e7202d4a25427c91b83ab8e1038e8fd33d561850cfed5fc11e7644576e1c54a13ff095db1086862192eea13d2d0568101b984911837066dc7f957cb39f10a6568248c507a5321f97a6448304c37c54c61b26d7144a90f08ae97bbb59caf1a12e261014347a", 0xd7}, {&(0x7f0000000240)="08ed79a2c0817af47854f130cbead2027b4ea85d8725d1ea93ec9c28b0fab96e547dd82b46e0ce7836636b1431ca32430d315dbc0f2b5f10a5cb688f4f95bb1d130dfd", 0x43}, {&(0x7f00000002c0)="c6df66ec9739c568cacf878da37cab8423d4d3ebca7a03bc79c64e7f5e2d8631f401e30f2b854c7ac1374c8de03f438e5834e6698e3c88d3634064fb7cd201a7a6611296b8a3440417f8d869189408546fe7f2b9a502f31588fd52219f9dec25cc1e52ba4abdc0f523e4af99c2274704f0958cb6d5f00e2cb541", 0x7a}], 0x4, 0x8, 0x1, {0x2}}, 0x6) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_io_uring_setup(0x6cde, &(0x7f0000000000)={0x0, 0x7940, 0x4, 0x3, 0x330}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) syz_io_uring_submit(r0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITEV={0x2, 0x3, 0x2000, @fd, 0x9, &(0x7f0000000340)=[{&(0x7f0000000100)="3e51b68770578f2ea4b8a7d6aea1e4c781ce420afa27", 0x16}, {&(0x7f0000000140)="740de3898eb95a5c73e068e5144a9b75bf304283df8c6acb21d5b3d1fd1439793e2333e87ea6eaa5db84ba6db4114fe3190517a1a9034db14334834347948e137bf69c3063368231f6f0066ec35d460603d7ece6586e332b797755c0d63901de30e91f07819cd24371c60e9e81d065d694e1e7202d4a25427c91b83ab8e1038e8fd33d561850cfed5fc11e7644576e1c54a13ff095db1086862192eea13d2d0568101b984911837066dc7f957cb39f10a6568248c507a5321f97a6448304c37c54c61b26d7144a90f08ae97bbb59caf1a12e261014347a", 0xd7}, {&(0x7f0000000240)="08ed79a2c0817af47854f130cbead2027b4ea85d8725d1ea93ec9c28b0fab96e547dd82b46e0ce7836636b1431ca32430d315dbc0f2b5f10a5cb688f4f95bb1d130dfd", 0x43}, {&(0x7f00000002c0)="c6df66ec9739c568cacf878da37cab8423d4d3ebca7a03bc79c64e7f5e2d8631f401e30f2b854c7ac1374c8de03f438e5834e6698e3c88d3634064fb7cd201a7a6611296b8a3440417f8d869189408546fe7f2b9a502f31588fd52219f9dec25cc1e52ba4abdc0f523e4af99c2274704f0958cb6d5f00e2cb541", 0x7a}], 0x4, 0x8, 0x1, {0x2}}, 0x6) (async) 00:11:54 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="024c3c9dc01def02f1807bae", @ANYRES32=r1, @ANYBLOB="0040001000000001000000ee497400640065000003049078ac050001e000000189179bac1e0101e0000001ac1414bb7f000001e0000002830bcfe000000164010102831fc17f000001ffffffff0a0101658f52249cf9dc3701ac14141700000000a60ddc3c9d0aaf4804a108cc850000"]}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f0000000400)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="00200020ffffffff0000000146cd00d80067000000049078ac1414aa0a010101643cfa417f00000100000136e000000200000007e00000027fffffff00000000ffffffffac141441000002000a01010200000000ac1414aa00000006831be6ac1414bb7f0000010a010102ac1e0101091414aa000000008303ad44109600000000090000000800000007445461516401010100000003ac1414250000000400000000000000c97f00000100000003e00000013ff39564c7eac6dc122afffffffeac1414bb000000ffac1414bbffffffff6401010000000401ac1e010100000009e000000100000008940400000000"]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x12}, 0x48) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x9903}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x0, &(0x7f0000000000)={0x0, 0xe628, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="024c3c9dc01def02f1807bae", @ANYRES32=r1, @ANYBLOB="0040001000000001000000ee497400640065000003049078ac050001e000000189179bac1e0101e0000001ac1414bb7f000001e0000002830bcfe000000164010102831fc17f000001ffffffff0a0101658f52249cf9dc3701ac14141700000000a60ddc3c9d0aaf4804a108cc850000"]}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f0000000400)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="00200020ffffffff0000000146cd00d80067000000049078ac1414aa0a010101643cfa417f00000100000136e000000200000007e00000027fffffff00000000ffffffffac141441000002000a01010200000000ac1414aa00000006831be6ac1414bb7f0000010a010102ac1e0101091414aa000000008303ad44109600000000090000000800000007445461516401010100000003ac1414250000000400000000000000c97f00000100000003e00000013ff39564c7eac6dc122afffffffeac1414bb000000ffac1414bbffffffff6401010000000401ac1e010100000009e000000100000008940400000000"]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58, &(0x7f0000000380)}, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="024c3c9dc01def02f1807bae", @ANYRES32=r1, @ANYBLOB="0040001000000001000000ee497400640065000003049078ac050001e000000189179bac1e0101e0000001ac1414bb7f000001e0000002830bcfe000000164010102831fc17f000001ffffffff0a0101658f52249cf9dc3701ac14141700000000a60ddc3c9d0aaf4804a108cc850000"]}) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f00000001c0)}, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f0000000400)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="00200020ffffffff0000000146cd00d80067000000049078ac1414aa0a010101643cfa417f00000100000136e000000200000007e00000027fffffff00000000ffffffffac141441000002000a01010200000000ac1414aa00000006831be6ac1414bb7f0000010a010102ac1e0101091414aa000000008303ad44109600000000090000000800000007445461516401010100000003ac1414250000000400000000000000c97f00000100000003e00000013ff39564c7eac6dc122afffffffeac1414bb000000ffac1414bbffffffff6401010000000401ac1e010100000009e000000100000008940400000000"]}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:54 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x6cde, &(0x7f0000000000)={0x0, 0x7940, 0x4, 0x3, 0x330}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_submit(r0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITEV={0x2, 0x3, 0x2000, @fd, 0x9, &(0x7f0000000340)=[{&(0x7f0000000100)="3e51b68770578f2ea4b8a7d6aea1e4c781ce420afa27", 0x16}, {&(0x7f0000000140)="740de3898eb95a5c73e068e5144a9b75bf304283df8c6acb21d5b3d1fd1439793e2333e87ea6eaa5db84ba6db4114fe3190517a1a9034db14334834347948e137bf69c3063368231f6f0066ec35d460603d7ece6586e332b797755c0d63901de30e91f07819cd24371c60e9e81d065d694e1e7202d4a25427c91b83ab8e1038e8fd33d561850cfed5fc11e7644576e1c54a13ff095db1086862192eea13d2d0568101b984911837066dc7f957cb39f10a6568248c507a5321f97a6448304c37c54c61b26d7144a90f08ae97bbb59caf1a12e261014347a", 0xd7}, {&(0x7f0000000240)="08ed79a2c0817af47854f130cbead2027b4ea85d8725d1ea93ec9c28b0fab96e547dd82b46e0ce7836636b1431ca32430d315dbc0f2b5f10a5cb688f4f95bb1d130dfd", 0x43}, {&(0x7f00000002c0)="c6df66ec9739c568cacf878da37cab8423d4d3ebca7a03bc79c64e7f5e2d8631f401e30f2b854c7ac1374c8de03f438e5834e6698e3c88d3634064fb7cd201a7a6611296b8a3440417f8d869189408546fe7f2b9a502f31588fd52219f9dec25cc1e52ba4abdc0f523e4af99c2274704f0958cb6d5f00e2cb541", 0x7a}], 0x4, 0x8, 0x1, {0x2}}, 0x6) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) syz_io_uring_setup(0x6cde, &(0x7f0000000000)={0x0, 0x7940, 0x4, 0x3, 0x330}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) (async) syz_io_uring_submit(r0, 0x0, &(0x7f0000000380)=@IORING_OP_WRITEV={0x2, 0x3, 0x2000, @fd, 0x9, &(0x7f0000000340)=[{&(0x7f0000000100)="3e51b68770578f2ea4b8a7d6aea1e4c781ce420afa27", 0x16}, {&(0x7f0000000140)="740de3898eb95a5c73e068e5144a9b75bf304283df8c6acb21d5b3d1fd1439793e2333e87ea6eaa5db84ba6db4114fe3190517a1a9034db14334834347948e137bf69c3063368231f6f0066ec35d460603d7ece6586e332b797755c0d63901de30e91f07819cd24371c60e9e81d065d694e1e7202d4a25427c91b83ab8e1038e8fd33d561850cfed5fc11e7644576e1c54a13ff095db1086862192eea13d2d0568101b984911837066dc7f957cb39f10a6568248c507a5321f97a6448304c37c54c61b26d7144a90f08ae97bbb59caf1a12e261014347a", 0xd7}, {&(0x7f0000000240)="08ed79a2c0817af47854f130cbead2027b4ea85d8725d1ea93ec9c28b0fab96e547dd82b46e0ce7836636b1431ca32430d315dbc0f2b5f10a5cb688f4f95bb1d130dfd", 0x43}, {&(0x7f00000002c0)="c6df66ec9739c568cacf878da37cab8423d4d3ebca7a03bc79c64e7f5e2d8631f401e30f2b854c7ac1374c8de03f438e5834e6698e3c88d3634064fb7cd201a7a6611296b8a3440417f8d869189408546fe7f2b9a502f31588fd52219f9dec25cc1e52ba4abdc0f523e4af99c2274704f0958cb6d5f00e2cb541", 0x7a}], 0x4, 0x8, 0x1, {0x2}}, 0x6) (async) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x13}, 0x48) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x7e50, 0x0, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="024c3c9dc01def02f1807bae", @ANYRES32=r1, @ANYBLOB="0040001000000001000000ee497400640065000003049078ac050001e000000189179bac1e0101e0000001ac1414bb7f000001e0000002830bcfe000000164010102831fc17f000001ffffffff0a0101658f52249cf9dc3701ac14141700000000a60ddc3c9d0aaf4804a108cc850000"]}) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f0000000400)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="00200020ffffffff0000000146cd00d80067000000049078ac1414aa0a010101643cfa417f00000100000136e000000200000007e00000027fffffff00000000ffffffffac141441000002000a01010200000000ac1414aa00000006831be6ac1414bb7f0000010a010102ac1e0101091414aa000000008303ad44109600000000090000000800000007445461516401010100000003ac1414250000000400000000000000c97f00000100000003e00000013ff39564c7eac6dc122afffffffeac1414bb000000ffac1414bbffffffff6401010000000401ac1e010100000009e000000100000008940400000000"]}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x14}, 0x48) 00:11:54 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000007, 0x11, 0xffffffffffffffff, 0x0) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x7e50, 0x0, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xda00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) 00:11:54 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000007, 0x11, 0xffffffffffffffff, 0x0) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x15}, 0x48) 00:11:54 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x7e50, 0x0, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x16}, 0x48) 00:11:54 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x8, &(0x7f0000ffc000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000007, 0x11, 0xffffffffffffffff, 0x0) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x400000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = userfaultfd(0xc0800) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x17}, 0x48) 00:11:54 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x600000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = userfaultfd(0xc0800) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) userfaultfd(0xc0800) (async) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}) (async) 00:11:54 executing program 0: mremap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffa000/0x2000)=nil) 00:11:54 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x2e2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:54 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:54 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x18}, 0x48) 00:11:55 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = userfaultfd(0xc0800) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x80ffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 0: mremap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffa000/0x2000)=nil) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x19}, 0x48) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000ffa000/0x4000)=nil) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket(0x2a, 0xa, 0x6) r1 = io_uring_setup(0x4675, &(0x7f0000000080)={0x0, 0x6c68, 0x10, 0x0, 0x20}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000001, 0x40010, r1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000200)={&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/88, 0x58, 0x0, &(0x7f0000000340)=""/204, 0xcc}, &(0x7f00000001c0)=0x40) io_uring_setup(0x61d5, &(0x7f0000000100)={0x0, 0x93c2, 0x20, 0x0, 0x249, 0x0, r1}) 00:11:55 executing program 0: mremap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffa000/0x2000)=nil) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xb0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0, &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1a}, 0x48) 00:11:55 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0xe, 0x969, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x24000010) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r3, 0x800, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x3}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20008060}, 0x54) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$dsp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, 0x4000010, r0, 0x0) 00:11:55 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 64) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000ffa000/0x4000)=nil) (async, rerun: 64) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket(0x2a, 0xa, 0x6) r1 = io_uring_setup(0x4675, &(0x7f0000000080)={0x0, 0x6c68, 0x10, 0x0, 0x20}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000001, 0x40010, r1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000200)={&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/88, 0x58, 0x0, &(0x7f0000000340)=""/204, 0xcc}, &(0x7f00000001c0)=0x40) (async) io_uring_setup(0x61d5, &(0x7f0000000100)={0x0, 0x93c2, 0x20, 0x0, 0x249, 0x0, r1}) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0, &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xc0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1b}, 0x48) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xa}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0xe, 0x969, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x24000010) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r3, 0x800, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x3}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20008060}, 0x54) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$dsp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, 0x4000010, r0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0xe, 0x969, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x24000010) (async) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r3, 0x800, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x3}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20008060}, 0x54) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$dsp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, 0x4000010, r0, 0x0) (async) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000ffa000/0x4000)=nil) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket(0x2a, 0xa, 0x6) r1 = io_uring_setup(0x4675, &(0x7f0000000080)={0x0, 0x6c68, 0x10, 0x0, 0x20}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000001, 0x40010, r1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000200)={&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/88, 0x58, 0x0, &(0x7f0000000340)=""/204, 0xcc}, &(0x7f00000001c0)=0x40) io_uring_setup(0x61d5, &(0x7f0000000100)={0x0, 0x93c2, 0x20, 0x0, 0x249, 0x0, r1}) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) (async) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000ffa000/0x4000)=nil) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket(0x2a, 0xa, 0x6) (async) io_uring_setup(0x4675, &(0x7f0000000080)={0x0, 0x6c68, 0x10, 0x0, 0x20}) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000001, 0x40010, r1, 0x0) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000200)={&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/88, 0x58, 0x0, &(0x7f0000000340)=""/204, 0xcc}, &(0x7f00000001c0)=0x40) (async) io_uring_setup(0x61d5, &(0x7f0000000100)={0x0, 0x93c2, 0x20, 0x0, 0x249, 0x0, r1}) (async) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0, &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xc}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1c}, 0x48) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:55 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$qrtrtun(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x2010, 0xffffffffffffffff, 0x8) 00:11:55 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_LINKS(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r3, 0x1, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r4, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) (async) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0xe, 0x969, @udp='udp:syz2\x00'}}}, ["", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40080}, 0x24000010) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, r3, 0x800, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x3}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20008060}, 0x54) (async, rerun: 64) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async, rerun: 64) mmap$dsp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, 0x4000010, r0, 0x0) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1d}, 0x48) 00:11:55 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$qrtrtun(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x2010, 0xffffffffffffffff, 0x8) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1e}, 0x48) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x10}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x4000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x13, r0, 0x0) 00:11:55 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$qrtrtun(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x2010, 0xffffffffffffffff, 0x8) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$qrtrtun(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x2010, 0xffffffffffffffff, 0x8) (async) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x21}, 0x48) 00:11:55 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) (async) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x12}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x6000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f0000000040)={{{0xe}}, 0x25, 0x4, &(0x7f0000000000)="7c367937b3eee222821779e754b4c59500d2192175adf0b07121164a2b5548b219bb4b9887"}) munlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0xfffffffffffffffe) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x22}, 0x48) 00:11:55 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) (async) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x18}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x23}, 0x48) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x7000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f0000000040)={{{0xe}}, 0x25, 0x4, &(0x7f0000000000)="7c367937b3eee222821779e754b4c59500d2192175adf0b07121164a2b5548b219bb4b9887"}) munlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) (async) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0xfffffffffffffffe) 00:11:55 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) 00:11:55 executing program 0: mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) 00:11:55 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x8000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:55 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1e}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f0000000040)={{{0xe}}, 0x25, 0x4, &(0x7f0000000000)="7c367937b3eee222821779e754b4c59500d2192175adf0b07121164a2b5548b219bb4b9887"}) (async) munlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) (async) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0xfffffffffffffffe) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x300}, 0x48) 00:11:56 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x461}, 0x48) 00:11:56 executing program 0: mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) (async) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x9000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x24}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) 00:11:56 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x5) get_mempolicy(&(0x7f0000000380), &(0x7f00000003c0), 0x3, &(0x7f0000ffd000/0x3000)=nil, 0x4) get_mempolicy(&(0x7f0000000080), &(0x7f00000000c0), 0x8000000000000000, &(0x7f0000ffc000/0x2000)=nil, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000300)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/197, 0xc5, 0x1, &(0x7f0000000240)=""/183, 0xb7}, &(0x7f0000000340)=0x40) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000100)={&(0x7f0000ffc000/0x3000)=nil, 0xc5, 0x5, 0x5}) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x500}, 0x48) 00:11:56 executing program 0: mremap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x3000, 0x0, &(0x7f0000ffa000/0x3000)=nil) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xa000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2a}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x600}, 0x48) 00:11:56 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x5) (async) get_mempolicy(&(0x7f0000000380), &(0x7f00000003c0), 0x3, &(0x7f0000ffd000/0x3000)=nil, 0x4) (async) get_mempolicy(&(0x7f0000000080), &(0x7f00000000c0), 0x8000000000000000, &(0x7f0000ffc000/0x2000)=nil, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000300)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/197, 0xc5, 0x1, &(0x7f0000000240)=""/183, 0xb7}, &(0x7f0000000340)=0x40) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000100)={&(0x7f0000ffc000/0x3000)=nil, 0xc5, 0x5, 0x5}) 00:11:56 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x30}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1, 0x4, 0x1}) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000001c0), 0x400080, 0x0) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000200)={&(0x7f0000ff9000/0x3000)=nil, 0x3000}) mremap(&(0x7f0000cec000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000380)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, {0x3}}, 0xea7ea6a) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f00000002c0), 0x4300, 0x0) socketpair(0x15, 0x4, 0x1, &(0x7f00000003c0)={0xffffffffffffffff}) getsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000400)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000480)=0x50) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x2}) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) r7 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r7, 0x65, 0x4, &(0x7f0000000340), 0x4) syz_io_uring_submit(r0, r6, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL={0xe, 0x5, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x1}, 0xffff) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x2, &(0x7f0000ffa000/0x3000)=nil, 0x7) 00:11:56 executing program 3: syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xc000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x5) get_mempolicy(&(0x7f0000000380), &(0x7f00000003c0), 0x3, &(0x7f0000ffd000/0x3000)=nil, 0x4) get_mempolicy(&(0x7f0000000080), &(0x7f00000000c0), 0x8000000000000000, &(0x7f0000ffc000/0x2000)=nil, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000300)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/197, 0xc5, 0x1, &(0x7f0000000240)=""/183, 0xb7}, &(0x7f0000000340)=0x40) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000100)={&(0x7f0000ffc000/0x3000)=nil, 0xc5, 0x5, 0x5}) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x5) (async) get_mempolicy(&(0x7f0000000380), &(0x7f00000003c0), 0x3, &(0x7f0000ffd000/0x3000)=nil, 0x4) (async) get_mempolicy(&(0x7f0000000080), &(0x7f00000000c0), 0x8000000000000000, &(0x7f0000ffc000/0x2000)=nil, 0x4) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000300)={&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/197, 0xc5, 0x1, &(0x7f0000000240)=""/183, 0xb7}, &(0x7f0000000340)=0x40) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000100)={&(0x7f0000ffc000/0x3000)=nil, 0xc5, 0x5, 0x5}) (async) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x700}, 0x48) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x36}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 3: syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 00:11:56 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1, 0x4, 0x1}) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000001c0), 0x400080, 0x0) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000200)={&(0x7f0000ff9000/0x3000)=nil, 0x3000}) (async) mremap(&(0x7f0000cec000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) (async) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000380)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, {0x3}}, 0xea7ea6a) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) (async) openat$drirender128(0xffffffffffffff9c, &(0x7f00000002c0), 0x4300, 0x0) (async) socketpair(0x15, 0x4, 0x1, &(0x7f00000003c0)={0xffffffffffffffff}) getsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000400)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000480)=0x50) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x2}) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async) r7 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r7, 0x65, 0x4, &(0x7f0000000340), 0x4) syz_io_uring_submit(r0, r6, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL={0xe, 0x5, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x1}, 0xffff) (async) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x2, &(0x7f0000ffa000/0x3000)=nil, 0x7) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x900}, 0x48) 00:11:56 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x10000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3c}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 3: syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xa00}, 0x48) 00:11:56 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) (async) 00:11:56 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1, 0x4, 0x1}) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000001c0), 0x400080, 0x0) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000200)={&(0x7f0000ff9000/0x3000)=nil, 0x3000}) mremap(&(0x7f0000cec000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000380)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, {0x3}}, 0xea7ea6a) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f00000002c0), 0x4300, 0x0) socketpair(0x15, 0x4, 0x1, &(0x7f00000003c0)={0xffffffffffffffff}) getsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000400)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000480)=0x50) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x2}) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) r7 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r7, 0x65, 0x4, &(0x7f0000000340), 0x4) syz_io_uring_submit(r0, r6, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) syz_io_uring_submit(r0, 0x0, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL={0xe, 0x5, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x1}, 0xffff) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x2, &(0x7f0000ffa000/0x3000)=nil, 0x7) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f00000000c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1, 0x4, 0x1}) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (async) openat$bsg(0xffffffffffffff9c, &(0x7f00000001c0), 0x400080, 0x0) (async) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000200)={&(0x7f0000ff9000/0x3000)=nil, 0x3000}) (async) mremap(&(0x7f0000cec000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) syz_io_uring_submit(r0, r1, &(0x7f0000000380)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, {0x3}}, 0xea7ea6a) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) (async) openat$drirender128(0xffffffffffffff9c, &(0x7f00000002c0), 0x4300, 0x0) (async) socketpair(0x15, 0x4, 0x1, &(0x7f00000003c0)) (async) getsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000400)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000480)=0x50) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x2}) (async) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xae47, 0x0, 0x0, 0x1de}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) (async) syz_io_uring_submit(r5, r6, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) (async) setsockopt$CAN_RAW_RECV_OWN_MSGS(r7, 0x65, 0x4, &(0x7f0000000340), 0x4) (async) syz_io_uring_submit(r0, r6, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x1, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x6490766e09914732}, 0x1}, 0x0) (async) syz_io_uring_submit(r0, 0x0, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL={0xe, 0x5, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x1}, 0xffff) (async) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x2, &(0x7f0000ffa000/0x3000)=nil, 0x7) (async) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x12000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) (async) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xb00}, 0x48) 00:11:56 executing program 3: syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x18000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 0: mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000, 0x7, &(0x7f0000ffb000/0x1000)=nil) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffb000/0x4000)=nil) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xc00}, 0x48) 00:11:56 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x60}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 1: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000), 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x4, &(0x7f0000ffb000/0x3000)=nil, 0x1) 00:11:56 executing program 0: mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000, 0x7, &(0x7f0000ffb000/0x1000)=nil) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffb000/0x4000)=nil) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xd00}, 0x48) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1e000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x121}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) 00:11:56 executing program 1: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000), 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x4, &(0x7f0000ffb000/0x3000)=nil, 0x1) 00:11:56 executing program 0: mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000, 0x7, &(0x7f0000ffb000/0x1000)=nil) (async) prctl$PR_SET_MM(0x23, 0x3, &(0x7f0000ffb000/0x4000)=nil) 00:11:56 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xe00}, 0x48) 00:11:56 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:56 executing program 3: r0 = syz_io_uring_setup(0x7e50, &(0x7f0000000000), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) 00:11:56 executing program 1: setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000), 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x4, &(0x7f0000ffb000/0x3000)=nil, 0x1) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x300}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$qrtrtun(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20070, r0, 0x7fffffff) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xf00}, 0x48) 00:11:57 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xda00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 1: read$sequencer(0xffffffffffffffff, &(0x7f0000000000)=""/90, 0x5a) write$sequencer(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="d2c1e438742eae2a7859c371db77c802cf725c7e72c7b04d5ad2411bade9643ee404470700000000000000c7ed23bcbc1b00000000000000e5d500f1638a78158b6d78c1000000000000"], 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) r1 = userfaultfd(0x1) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) ioctl$SNDCTL_TMR_TEMPO(r0, 0xc0045405, &(0x7f0000000080)=0x94) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20ffafff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$qrtrtun(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20070, r0, 0x7fffffff) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1100}, 0x48) 00:11:57 executing program 1: read$sequencer(0xffffffffffffffff, &(0x7f0000000000)=""/90, 0x5a) write$sequencer(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="d2c1e438742eae2a7859c371db77c802cf725c7e72c7b04d5ad2411bade9643ee404470700000000000000c7ed23bcbc1b00000000000000e5d500f1638a78158b6d78c1000000000000"], 0x4) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) (async) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) r1 = userfaultfd(0x1) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) (async) ioctl$SNDCTL_TMR_TEMPO(r0, 0xc0045405, &(0x7f0000000080)=0x94) 00:11:57 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="024c3c9dc01def02f1807bae", @ANYRES32=r1, @ANYBLOB="0040001000000001000000ee497400640065000003049078ac050001e000000189179bac1e0101e0000001ac1414bb7f000001e0000002830bcfe000000164010102831fc17f000001ffffffff0a0101658f52249cf9dc3701ac14141700000000a60ddc3c9d0aaf4804a108cc850000"]}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000340)={'tunl0\x00', &(0x7f0000000400)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="00200020ffffffff0000000146cd00d80067000000049078ac1414aa0a010101643cfa417f00000100000136e000000200000007e00000027fffffff00000000ffffffffac141441000002000a01010200000000ac1414aa00000006831be6ac1414bb7f0000010a010102ac1e0101091414aa000000008303ad44109600000000090000000800000007445461516401010100000003ac1414250000000400000000000000c97f00000100000003e00000013ff39564c7eac6dc122afffffffeac1414bb000000ffac1414bbffffffff6401010000000401ac1e010100000009e000000100000008940400000000"]}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20ffb000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$qrtrtun(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20070, r0, 0x7fffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$qrtrtun(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x20070, r0, 0x7fffffff) (async) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x700}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1200}, 0x48) 00:11:57 executing program 1: read$sequencer(0xffffffffffffffff, &(0x7f0000000000)=""/90, 0x5a) (async) write$sequencer(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="d2c1e438742eae2a7859c371db77c802cf725c7e72c7b04d5ad2411bade9643ee404470700000000000000c7ed23bcbc1b00000000000000e5d500f1638a78158b6d78c1000000000000"], 0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) (async) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r0, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) r1 = userfaultfd(0x1) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) ioctl$SNDCTL_TMR_TEMPO(r0, 0xc0045405, &(0x7f0000000080)=0x94) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20ffbfff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x6000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x2}) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1300}, 0x48) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x20ffc000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x900}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3c00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1400}, 0x48) 00:11:57 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x2}) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x2}) (async) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:57 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x11, 0x0, &(0x7f00000000c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x21010000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xa00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x2}) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x2}) (async) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1500}, 0x48) 00:11:57 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x11, 0x0, &(0x7f00000000c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) socket$inet_tcp(0x2, 0x1, 0x0) (async) getsockopt$inet_tcp_int(r0, 0x6, 0x11, 0x0, &(0x7f00000000c0)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x24000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1600}, 0x48) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xc00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x11, 0x0, &(0x7f00000000c0)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:57 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x24030000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1700}, 0x48) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x26030000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) 00:11:57 executing program 1: ioctl$USBDEVFS_RESET(0xffffffffffffffff, 0x5514) write$sequencer(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0aff000403fe03eb00930080fa7278fbc2"], 0x11) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xb000, 0x0, &(0x7f0000ff5000/0xb000)=nil) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1800}, 0x48) 00:11:57 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) 00:11:57 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x2a000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 1: ioctl$USBDEVFS_RESET(0xffffffffffffffff, 0x5514) (async) write$sequencer(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0aff000403fe03eb00930080fa7278fbc2"], 0x11) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xb000, 0x0, &(0x7f0000ff5000/0xb000)=nil) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1900}, 0x48) 00:11:57 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:11:57 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x30000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:57 executing program 1: ioctl$USBDEVFS_RESET(0xffffffffffffffff, 0x5514) (async) write$sequencer(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0aff000403fe03eb00930080fa7278fbc2"], 0x11) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xb000, 0x0, &(0x7f0000ff5000/0xb000)=nil) 00:11:57 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1a00}, 0x48) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1e00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 3: syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x36000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1b00}, 0x48) 00:11:58 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (async) 00:11:58 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000000)) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) ioctl$USBDEVFS_CLAIMINTERFACE(r3, 0x8004550f, &(0x7f0000000340)=0x52) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) ioctl$SNDCTL_SYNTH_INFO(r2, 0xc08c5102, &(0x7f0000000180)={"74b4b1e13dcefbe6fd5ac63574c2d1f700000000000500", 0x3cf5, 0x1, 0x1, 0x0, 0x7fff, 0x10006, 0x80000000, 0x2, [0xfffffffd, 0x4, 0x5, 0xeeb, 0xc45f, 0x400, 0x18d, 0xffff7c01, 0x9, 0x5, 0x2, 0x84, 0x9, 0x100, 0x80, 0x3, 0x1, 0x72d, 0x6]}) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) r4 = syz_open_dev$media(&(0x7f0000000040), 0x10000, 0x74a00) ioctl$MEDIA_IOC_ENUM_ENTITIES(r4, 0xc1007c01, &(0x7f0000000080)) ioctl$USBDEVFS_GET_SPEED(r1, 0x551f) r5 = syz_open_dev$usbfs(&(0x7f0000000240), 0x800, 0x140) ioctl$USBDEVFS_DISCSIGNAL(r5, 0x8010550e, &(0x7f0000000300)={0x2, &(0x7f0000000280)="19b781b62aaa79af4d994a52e7c1beb80dca931a57bc1c57043c59af25329b806a84fb1b4ba0e70cbdb31cd68d0fcc029f989f9fd4908105a76d8a06994637da40fe29d68329009b4f9af4788c825542932da2203f861491700fa3d2"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x39030000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1c00}, 0x48) 00:11:58 executing program 3: syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000000)) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) (async) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) r3 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_CLAIMINTERFACE(r3, 0x8004550f, &(0x7f0000000340)=0x52) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_SYNTH_INFO(r2, 0xc08c5102, &(0x7f0000000180)={"74b4b1e13dcefbe6fd5ac63574c2d1f700000000000500", 0x3cf5, 0x1, 0x1, 0x0, 0x7fff, 0x10006, 0x80000000, 0x2, [0xfffffffd, 0x4, 0x5, 0xeeb, 0xc45f, 0x400, 0x18d, 0xffff7c01, 0x9, 0x5, 0x2, 0x84, 0x9, 0x100, 0x80, 0x3, 0x1, 0x72d, 0x6]}) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async, rerun: 64) r4 = syz_open_dev$media(&(0x7f0000000040), 0x10000, 0x74a00) (rerun: 64) ioctl$MEDIA_IOC_ENUM_ENTITIES(r4, 0xc1007c01, &(0x7f0000000080)) (async) ioctl$USBDEVFS_GET_SPEED(r1, 0x551f) (async, rerun: 32) r5 = syz_open_dev$usbfs(&(0x7f0000000240), 0x800, 0x140) (rerun: 32) ioctl$USBDEVFS_DISCSIGNAL(r5, 0x8010550e, &(0x7f0000000300)={0x2, &(0x7f0000000280)="19b781b62aaa79af4d994a52e7c1beb80dca931a57bc1c57043c59af25329b806a84fb1b4ba0e70cbdb31cd68d0fcc029f989f9fd4908105a76d8a06994637da40fe29d68329009b4f9af4788c825542932da2203f861491700fa3d2"}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1d00}, 0x48) 00:11:58 executing program 3: syz_io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3c000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1e00}, 0x48) 00:11:58 executing program 3: syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 1: r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_DROP_PRIVILEGES(r0, 0x4004551e, &(0x7f0000000000)) r1 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) (async) r3 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0) (async) ioctl$USBDEVFS_CLAIMINTERFACE(r3, 0x8004550f, &(0x7f0000000340)=0x52) ioctl$SNDCTL_SEQ_TESTMIDI(r2, 0x40045108, &(0x7f00000016c0)=0x80000000) (async) ioctl$SNDCTL_SYNTH_INFO(r2, 0xc08c5102, &(0x7f0000000180)={"74b4b1e13dcefbe6fd5ac63574c2d1f700000000000500", 0x3cf5, 0x1, 0x1, 0x0, 0x7fff, 0x10006, 0x80000000, 0x2, [0xfffffffd, 0x4, 0x5, 0xeeb, 0xc45f, 0x400, 0x18d, 0xffff7c01, 0x9, 0x5, 0x2, 0x84, 0x9, 0x100, 0x80, 0x3, 0x1, 0x72d, 0x6]}) (async) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, 0x0) (async) r4 = syz_open_dev$media(&(0x7f0000000040), 0x10000, 0x74a00) ioctl$MEDIA_IOC_ENUM_ENTITIES(r4, 0xc1007c01, &(0x7f0000000080)) (async) ioctl$USBDEVFS_GET_SPEED(r1, 0x551f) (async) r5 = syz_open_dev$usbfs(&(0x7f0000000240), 0x800, 0x140) ioctl$USBDEVFS_DISCSIGNAL(r5, 0x8010550e, &(0x7f0000000300)={0x2, &(0x7f0000000280)="19b781b62aaa79af4d994a52e7c1beb80dca931a57bc1c57043c59af25329b806a84fb1b4ba0e70cbdb31cd68d0fcc029f989f9fd4908105a76d8a06994637da40fe29d68329009b4f9af4788c825542932da2203f861491700fa3d2"}) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2101}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3d000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r1) ioctl$SIOCGETSGCNT_IN6(r1, 0x89e1, &(0x7f0000000000)={@private0={0xfc, 0x0, '\x00', 0x1}, @empty}) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x8) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1f00}, 0x48) 00:11:58 executing program 3: syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffa000/0x3000)=nil) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x3f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) r1 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r1) ioctl$SIOCGETSGCNT_IN6(r1, 0x89e1, &(0x7f0000000000)={@private0={0xfc, 0x0, '\x00', 0x1}, @empty}) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x8) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2400}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2000}, 0x48) 00:11:58 executing program 3: syz_io_uring_setup(0x43c6, 0x0, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffa000/0x3000)=nil) 00:11:58 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 32) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (rerun: 32) r1 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r1) (async) ioctl$SIOCGETSGCNT_IN6(r1, 0x89e1, &(0x7f0000000000)={@private0={0xfc, 0x0, '\x00', 0x1}, @empty}) (async) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x8) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x40000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2100}, 0x48) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2a00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 64) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffa000/0x3000)=nil) (rerun: 64) 00:11:58 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x42000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2200}, 0x48) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/188, 0xbc, 0x1, 0xfffffffffffffffc}, &(0x7f0000000140)=0x40) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, 0xffffffffffffffff, 0x0, 0x4}) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x76f83, 0x0) 00:11:58 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x5) 00:11:58 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2300}, 0x48) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x55400fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/188, 0xbc, 0x1, 0xfffffffffffffffc}, &(0x7f0000000140)=0x40) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, 0xffffffffffffffff, 0x0, 0x4}) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x76f83, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/188, 0xbc, 0x1, 0xfffffffffffffffc}, &(0x7f0000000140)=0x40) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, 0xffffffffffffffff, 0x0, 0x4}) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x76f83, 0x0) (async) 00:11:58 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x5) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x3f00}, 0x48) 00:11:58 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x55520fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/188, 0xbc, 0x1, 0xfffffffffffffffc}, &(0x7f0000000140)=0x40) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, 0xffffffffffffffff, 0x0, 0x4}) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x76f83, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/188, 0xbc, 0x1, 0xfffffffffffffffc}, &(0x7f0000000140)=0x40) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, 0xffffffffffffffff, 0x0, 0x4}) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x76f83, 0x0) (async) 00:11:58 executing program 1: mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x5) 00:11:58 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:58 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x4000}, 0x48) 00:11:58 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3c00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:58 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x55600fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x5, 0x100010, r0, 0x0) 00:11:59 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:59 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x2, &(0x7f0000ffa000/0x4000)=nil) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6104}, 0x48) 00:11:59 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x557fffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x5, 0x100010, r0, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) (async) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x5, 0x100010, r0, 0x0) (async) 00:11:59 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x2, &(0x7f0000ffa000/0x4000)=nil) 00:11:59 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, &(0x7f0000000180)) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x400000}, 0x48) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x5, 0x100010, r0, 0x0) 00:11:59 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x99030000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x2, &(0x7f0000ffa000/0x4000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4000, 0x2, &(0x7f0000ffa000/0x4000)=nil) (async) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$dsp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000004, 0x13, 0xffffffffffffffff, 0x0) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x80ffff}, 0x48) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xd8000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:59 executing program 0: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x4, &(0x7f0000ff8000/0x4000)=nil) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) 00:11:59 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 3: syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), 0x0) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xda000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1000000}, 0x48) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$dsp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000004, 0x13, 0xffffffffffffffff, 0x0) 00:11:59 executing program 0: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x4, &(0x7f0000ff8000/0x4000)=nil) (async) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) 00:11:59 executing program 3: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2000000}, 0x48) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$dsp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000004, 0x13, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mmap$dsp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000004, 0x13, 0xffffffffffffffff, 0x0) (async) 00:11:59 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xfeffffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 0: mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4000, 0x4, &(0x7f0000ff8000/0x4000)=nil) (async, rerun: 64) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) (rerun: 64) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x3000000}, 0x48) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x2d26, 0x2, 0x8}) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xff0f4055}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mlock2(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1) 00:11:59 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 3: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x2d26, 0x2, 0x8}) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x4000000}, 0x48) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xff0f5255}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async, rerun: 32) mlock2(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1) (rerun: 32) 00:11:59 executing program 1: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffc000/0x3000)=nil, 0x2d26, 0x2, 0x8}) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x5000000}, 0x48) 00:11:59 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x400000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 3: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xff0f6055}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) mlock2(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6000000}, 0x48) 00:11:59 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x5000000}, 0x48) 00:11:59 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x7660, &(0x7f0000ffd000/0x1000)=nil, 0x0) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xffafff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x7000000}, 0x48) 00:11:59 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xffbfff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:11:59 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x7660, &(0x7f0000ffd000/0x1000)=nil, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x7660, &(0x7f0000ffd000/0x1000)=nil, 0x0) (async) 00:11:59 executing program 3: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x8000000}, 0x48) 00:12:00 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x80ffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x7000000}, 0x48) 00:12:00 executing program 0: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x7660, &(0x7f0000ffd000/0x1000)=nil, 0x0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x7660, &(0x7f0000ffd000/0x1000)=nil, 0x0) (async) 00:12:00 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xffff7f55}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x9000000}, 0x48) 00:12:00 executing program 0: ioctl$USBDEVFS_RESET(0xffffffffffffffff, 0x5514) write$sequencer(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0aff000403fe03eb00930080fa7278fbc2"], 0x11) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xb000, 0x0, &(0x7f0000ff5000/0xb000)=nil) 00:12:00 executing program 1: r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffe000/0x2000)=nil) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@mcast1, @private0={0xfc, 0x0, '\x00', 0x1}}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:00 executing program 3: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xb0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xffff8000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xa000000}, 0x48) 00:12:00 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x80ffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 1: r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffe000/0x2000)=nil) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@mcast1, @private0={0xfc, 0x0, '\x00', 0x1}}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xb000000}, 0x48) 00:12:00 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xc0ff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0xfffffffe}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 1: r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffe000/0x2000)=nil) ioctl$SIOCGETSGCNT_IN6(r0, 0x89e1, &(0x7f0000000000)={@mcast1, @private0={0xfc, 0x0, '\x00', 0x1}}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:00 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xc000000}, 0x48) 00:12:00 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 1: r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000ffe000/0x2000)=nil) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xd000000}, 0x48) 00:12:00 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 1: r0 = socket$igmp(0x2, 0x3, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r0) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xe000000}, 0x48) 00:12:00 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 1: socket$igmp(0x2, 0x3, 0x2) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xf000000}, 0x48) 00:12:00 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 1: socket$igmp(0x2, 0x3, 0x2) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x10000000}, 0x48) 00:12:00 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:00 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:00 executing program 1: socket$igmp(0x2, 0x3, 0x2) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:00 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x11000000}, 0x48) 00:12:00 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:00 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:00 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:00 executing program 1: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x12000000}, 0x48) 00:12:01 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x13000000}, 0x48) 00:12:01 executing program 3: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 1: syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:01 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 1: syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x14000000}, 0x48) 00:12:01 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x15000000}, 0x48) 00:12:01 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:01 executing program 3: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 1: syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x16000000}, 0x48) 00:12:01 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xa000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:01 executing program 1: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) 00:12:01 executing program 3: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xa}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x17000000}, 0x48) 00:12:01 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xc000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:01 executing program 1: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) 00:12:01 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xc}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x18000000}, 0x48) 00:12:01 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 1: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) 00:12:01 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x19000000}, 0x48) 00:12:01 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) 00:12:01 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1a000000}, 0x48) 00:12:01 executing program 0: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x10}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1b000000}, 0x48) 00:12:01 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x12000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x12}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:01 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x60872, 0xffffffffffffffff, 0x0) 00:12:01 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x1f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffafff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1c000000}, 0x48) 00:12:02 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x18000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x18}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1d000000}, 0x48) 00:12:02 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffafff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xff0f4055}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1e000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1e}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1e000000}, 0x48) 00:12:02 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x10, 0xffffffffffffffff, 0x0) 00:12:02 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x24}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x1f000000}, 0x48) 00:12:02 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x18}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x18000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x20000000}, 0x48) 00:12:02 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2a}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x24}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x21000000}, 0x48) 00:12:02 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x30}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) getsockopt$inet_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) 00:12:02 executing program 3: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) mremap(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x1000, 0x3, &(0x7f0000ffd000/0x1000)=nil) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) mmap$usbfs(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x1010, r0, 0x5) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0xffffffffffffffff, 0xcc000) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0x800, 0x242) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000280)=@urb_type_iso={0x0, {0x9}, 0x1, 0x84, &(0x7f0000000180)="93e1b7d5148fe064c4a4430441c845788d924283dea12a14497b860ab75d078754ca04c715d72abab1ce508bf2fa9de9f594b467cd469865b3ea5721429a713b351488c0eb5dce2820", 0x49, 0x8, 0x81, 0x7f, 0x7fffffff, 0x3, &(0x7f0000000200)="a1d5496ccc241851dc13bf228ce8565daca35f49c7c5301c877d612e921393094bad8c6538197b11fa98f1777c22b03c1967622989e6e4748c8dad91245dee6c99847619ffa9719c716c1b1512279973e9d5a3a57f9e644ccb7d870dfc7a94f521bd018c8a", [{0x58, 0x8, 0x401}, {0x8001, 0x4, 0x7fff}, {0x52e0, 0x2, 0x6}, {0x0, 0x4, 0x8}, {0x3, 0x2, 0x3}, {0x7f, 0x80, 0x1a}, {0x7, 0xff, 0x3}, {0x4, 0xd6c, 0x20002000}, {0x6442, 0x582, 0x9}, {0xe2, 0x81, 0x5d80}, {0x4, 0x0, 0x6}, {0x5, 0x400, 0x8}, {0x1, 0x2, 0x1}, {0x8, 0x15ca, 0x6126}, {0x1, 0xbc26, 0x6}, {0x0, 0x9, 0xf485}, {0x4, 0xbdf, 0x800}, {0x4, 0x20, 0xffffffde}, {0xb68, 0x8}, {0x335, 0x0, 0x7f}, {0x2, 0x0, 0x1}, {0xeee2, 0x8, 0x9}, {0x800000, 0x10000, 0x9}, {0x1, 0xff, 0x400}, {0x3, 0x6f9a, 0x2400}, {0x1f, 0xffff, 0x3}, {0x1, 0x86c, 0x7b}, {0x1, 0x1000, 0x1}, {0x400, 0x8106, 0xffff8000}, {0x800, 0xa7, 0xffffff7f}, {0x80, 0x48e0, 0x4}, {0x7, 0x10001, 0x7f}, {0x4, 0x8000, 0xca13}, {0x3, 0x1, 0xfffffff9}, {0x5, 0x4, 0x8}, {0x80, 0x2, 0x6}, {0x0, 0x7f, 0x5}, {0x0, 0x8722, 0xfffffffb}, {0xfffffffe, 0x6, 0x7}, {0x1, 0x8000, 0xffff0001}, {0xd96, 0x2, 0x58}, {0x1ff, 0x2, 0x61}, {0x5a, 0xd9be, 0x7}, {0x4, 0x996}, {0x0, 0xa15f, 0x3ff}, {0x3, 0x0, 0x7}, {0xfffffffa, 0x481, 0x113}, {0x3, 0xff, 0x6}, {0x9, 0x7f, 0x3ff}, {0x800, 0x8, 0x8}, {0x85c00000, 0x5, 0x1f}, {0x7, 0x61f, 0xffffffff}, {0x911f37df, 0x4, 0x657c}, {0x800, 0x779, 0x7b2}, {0x7fff, 0x6, 0x6}, {0x401, 0x4, 0x2}, {0x7, 0x5, 0x19}, {0x1ff, 0x3f, 0x81}, {0xec3, 0x341}, {0xff, 0x8, 0x80}, {0x2, 0x9, 0x1}, {0x8000, 0x0, 0x41245ca}, {0x3f, 0x100, 0x1}, {0x9, 0x6, 0x5}, {0x0, 0x2, 0x7}, {0x10000, 0x8, 0x40000003}, {0x1f, 0x8, 0x9}, {0x6, 0x7f, 0x6}, {0x7, 0xa06d, 0x9}, {0x8, 0x2, 0x400}, {0x2ad9, 0x7, 0x80000000}, {0x6e, 0x0, 0x7}, {0x0, 0x9, 0x3}, {0x1ff, 0xc4, 0x7}, {0x0, 0x4, 0xffffffff}, {0x9d, 0xfffffff9, 0x7fffffff}, {0x9, 0x6, 0x3}, {0x3, 0x500, 0x4}, {0x6, 0x6, 0x9}, {0x101, 0x20, 0x5}, {0x9f, 0x3, 0x9}, {0x5, 0xe11, 0x5652cfe6}, {0xc1f00000, 0x9, 0x6}, {0x6, 0x81, 0x6}, {0x5, 0xffff8692, 0x3}, {0x326b59f7, 0x5, 0x9}, {0x3, 0x1}, {0x1, 0x7, 0x5}, {0x6, 0x2, 0x7}, {0x7, 0x1, 0x9}, {0x9, 0xc5b}, {0x2, 0x9, 0x5}, {0x4, 0xf6b, 0xfffffffe}, {0x8, 0x7, 0x5}, {0x8, 0x2}, {0x5, 0x10000, 0x40}, {0x9, 0x9, 0x1}, {0xffff, 0x1, 0x2}, {0x4, 0x5, 0x2}, {0xffffffff, 0x2649, 0x10000}, {0x7, 0x2, 0x3}, {0x7, 0x35, 0x8}, {0x1f, 0x200, 0x40}, {0x30000, 0x101, 0x7}, {0x73f3, 0x80000001}, {0xff, 0x0, 0x40}, {0x80000001, 0xc82, 0x1ff}, {0x4, 0xffff77ca, 0x3}, {0x100, 0x0, 0x2}, {0x0, 0x6, 0x1ff}, {0x7fff, 0x8, 0x1000}, {0x0, 0x7, 0x2}, {0x1, 0x5, 0x800}, {0xfffffffc, 0x6, 0x4}, {0x3, 0x7f, 0x8}, {0x2, 0x7f, 0x3}, {0x1000, 0x7, 0xffff}, {0x137, 0x4, 0x6}, {0x7f, 0x2, 0x1}, {0x8, 0x2, 0x1000}, {0x1, 0xf46, 0xcd}, {0x2, 0xffffffba, 0x1}, {0x2, 0x8, 0x7}, {0x4800, 0x0, 0x400}, {0x6, 0x6, 0x6}, {0x7fff, 0xe89e, 0x40}, {0x2, 0x9, 0x9}]}) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffa000/0x4000)=nil, 0x4000}) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x6) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom1\x00', 0x3, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0x81) r5 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r5, 0x8108551b, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x80000000) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, &(0x7f0000000080)={0x6, &(0x7f0000000040)="6f4dd333250287f7a6b64ada2a796f2b2b027ca52af80baeb74ecc75c5fbf72d1cacc0933abe27ec34d26d5c83e857b320994f0a82c9db"}) 00:12:02 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20ffafff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x22000000}, 0x48) 00:12:02 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) read$sequencer(r1, &(0x7f00000000c0)=""/176, 0xb0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:12:02 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x36}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffc000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x23000000}, 0x48) 00:12:02 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffbfff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20ffb000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3c}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffafff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x3f000000}, 0x48) 00:12:02 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x61040000}, 0x48) 00:12:02 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20ffbfff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xff0f004b}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xffafff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3d}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x10000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:02 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xe4ffffff}, 0x48) 00:12:03 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000440)={&(0x7f0000000380), 0xc, 0x0}, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x240000c1}, 0x40000) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @loopback, 0x0, 0x2011}}) 00:12:03 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20ffc000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20ffbfff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x36000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xffff8000}, 0x48) 00:12:03 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x60}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0xffffffe4}, 0x48) 00:12:03 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x21010000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffbfff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20ffafff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:12:03 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x24000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2}, 0x48) 00:12:03 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x20000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3}, 0x48) 00:12:03 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xda}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 3: mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff000, 0x0, &(0x7f0000ffb000/0x2000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x9, &(0x7f0000ffd000/0x3000)=nil, 0x3) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x1, 0x11, r0, 0xd7be) mlock2(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f0000000100)) 00:12:03 executing program 0: bpf$MAP_CREATE(0x1b00000000000000, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x48) 00:12:03 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2a000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x6000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x48) 00:12:03 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x4200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x30000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x121}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xda}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x48) 00:12:03 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x3f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x36000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x300}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x6}, 0x48) 00:12:03 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2403}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x1800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x7}, 0x48) 00:12:03 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x400000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3c000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x700}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x324}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x8}, 0x48) 00:12:03 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xda}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xa00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x2a}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:03 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x9}, 0x48) 00:12:03 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x326}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x40000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 1: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xa}, 0x48) 00:12:04 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x42}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0xa}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xb}, 0x48) 00:12:04 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x339}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x8}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x42000000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001680), 0x0, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r1, 0x40045108, &(0x7f00000016c0)=0x80000000) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x204802, 0x0) read$sequencer(r2, &(0x7f00000000c0)=""/4096, 0x1000) ioctl$SNDCTL_SEQ_PANIC(r1, 0x5111) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x200e}}) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xc}, 0x48) 00:12:04 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 3: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x7}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4b000fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xd}, 0x48) 00:12:04 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x399}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 0: ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000000)={0x0, 0x3, 0xffffffffffffffff, 0x8, 0x80000}) r0 = syz_open_dev$usbfs(&(0x7f00000011c0), 0x200, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f00000000c0)=@urb_type_control={0x2, {}, 0xffff, 0x4, &(0x7f0000000040)={0x5, 0x14, 0x400, 0x1000, 0x8}, 0x8, 0x2, 0x1, 0x0, 0xffff8001, 0x9, &(0x7f0000000080)="ed18b0b719dfdaf04cdab8bdbff18872cc2529c303cf517a38ef1746ffeea73aa379a9ef919f9a4c15b901d8a9e8ddded37f61f49d356ac86a8f711a05c1"}) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x7ffffffff000, 0x7ffffffff002, 0x0, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$usbfs(&(0x7f0000000100), 0x5d, 0x20200) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4b120fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100)=[@window, @timestamp, @sack_perm, @mss], 0x4) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f00000000c0)={{{0x2, 0x1}}, 0xee, 0x4, &(0x7f0000000140)="00225c752219b89052e515a67a6420bb97826ded9a4d5c0f7b5ffeb7a738ffe0876dc3f647c12d1d3ac017ed2ef9caa27f4480c0c1b26efba35480145ec389802054a1994419838babebb2a72b41838057f35730e81019069c4f23157c8d11c72732071f7c8088ed5d15f13c4c60f4647e8706e86a3acc9d1ec7f5af947fe160656cebae28dcbb177f4a8d1b67f9d4d7ad29334cc8a7bc58ee8b2054213c49c7d2b8586aed30a9663af2d70cfb0b28c4f506f3af1a11560154a0158254947b838f46c5e260a3c115872b0fa20ecea3ada82ca2d120dcc26a0740b156d6bb5cd1bc6844df4181e16becce6b2de86a"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x40, 0x1, 0x8, 0x0, {{0x3b, 0x4, 0x2, 0x3, 0xec, 0x68, 0x0, 0x7, 0x29, 0x0, @rand_addr=0x64010102, @local, {[@ssrr={0x89, 0x2b, 0x2e, [@rand_addr=0x64010102, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @broadcast, @local, @loopback]}, @timestamp={0x44, 0x14, 0xb0, 0x0, 0x6, [0x6, 0x6, 0x5, 0xeb]}, @timestamp_prespec={0x44, 0x3c, 0x8c, 0x3, 0x5, [{@multicast1}, {@empty}, {@rand_addr=0x64010100, 0x10000}, {@broadcast, 0xff45}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xedf3}, {@remote}, {@multicast1, 0xa091}]}, @cipso={0x86, 0x2d, 0x2, [{0x6, 0x11, "177b8481bf6698a0da9fe15b2b13c6"}, {0x0, 0x6, "79740aaf"}, {0x5, 0x10, "ab29f7fdf132f291771a3591ab31"}]}, @ssrr={0x89, 0xb, 0x83, [@dev={0xac, 0x14, 0x14, 0x1a}, @multicast2]}, @timestamp_addr={0x44, 0x24, 0xc5, 0x1, 0xa, [{@dev={0xac, 0x14, 0x14, 0x1b}, 0x1}, {@remote, 0x3f}, {@multicast2, 0x4}, {@loopback, 0x6}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)={@private0, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x2011}}) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xe}, 0x48) 00:12:04 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 1) 00:12:04 executing program 0: mremap(&(0x7f0000ff1000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) mremap(&(0x7f0000ff5000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000680)={{&(0x7f0000fec000/0x3000)=nil, 0x3000}, 0x1}) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000006c0)={0x7}) munlock(&(0x7f0000ff7000/0x1000)=nil, 0x1000) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) mmap$usbfs(&(0x7f0000ff2000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x800) openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000004c0), 0x2083) syz_io_uring_setup(0x43dc, &(0x7f0000000280)={0x0, 0xdcb0, 0x2, 0x0, 0x35b, 0x0, r0}, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000300), &(0x7f0000000340)) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/165, 0xa5, 0x0, &(0x7f00000000c0)=""/182, 0xb6}, &(0x7f00000001c0)=0x40) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x2, 0x70bd27, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080) ioctl$SOUND_MIXER_INFO(0xffffffffffffffff, 0x805c4d65, &(0x7f0000000200)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000500)="c4962aa1ae8928c52a94788bfe6c9dbdd902dae904d2a668cad916be6bf28d0fd5b81eb571af3d8d029e1ac4137328074f96ddc7d2684f07a4c4448c108b6ff5888ad1beff1fbd8c7069ca7f1c1c677b939e9b0b196db0106e4fb068eb60c586a58323f8e7054d64c320f2d092b8633729d83672e1f547dd01b7e14682b0481806ceca7d84a21ce200ddb05bcef90462fe8ecbfbdefc224b282c24b99a7497c08ce8de6c247c1ec2a0e17ed3b0f0454f23d03d5588bd1b58431e553a830f31b6e6b21729", &(0x7f0000000600)=@udp=r0, 0x2}, 0x20) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x56e00fff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xf}, 0x48) 00:12:04 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x700}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 0: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 2) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x10}, 0x48) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x56ffffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 1) 00:12:04 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x900}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 3) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x11}, 0x48) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfeffffff}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 1) 00:12:04 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 4) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xff0f004b}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 2) 00:12:04 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xa00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x12}, 0x48) 00:12:04 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 2) 00:12:04 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 5) 00:12:04 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xff0f124b}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:04 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x13}, 0x48) 00:12:04 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 3) 00:12:04 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 3) 00:12:05 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 6) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 4) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x14}, 0x48) 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 4) 00:12:05 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xc00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xff0fe056}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 7) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x15}, 0x48) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 5) 00:12:05 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffafff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 5) 00:12:05 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xd00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 8) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x16}, 0x48) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 6) 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 6) 00:12:05 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffbfff20}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 9) 00:12:05 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1200}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x17}, 0x48) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 7) 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 7) [ 2810.932123][ T28] audit: type=1800 audit(1655856725.340:186): pid=6112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor.1" name="anon_hugepage" dev="hugetlbfs" ino=815245 res=0 errno=0 00:12:05 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 10) 00:12:05 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffff8000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 8) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x18}, 0x48) 00:12:05 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1800}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 8) 00:12:05 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffffff56}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 9) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x19}, 0x48) 00:12:05 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 11) 00:12:05 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1e00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) [ 2811.128387][ T28] audit: type=1800 audit(1655856725.540:187): pid=6128 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor.1" name="anon_hugepage" dev="hugetlbfs" ino=816308 res=0 errno=0 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 9) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 10) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1a}, 0x48) 00:12:05 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfffffffe}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1f00}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 12) 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 10) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 11) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1b}, 0x48) 00:12:05 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 11) 00:12:05 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1c}, 0x48) 00:12:05 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 13) [ 2811.467335][ T28] audit: type=1804 audit(1655856725.880:188): pid=6158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=add_template_measure cause=ENOMEM comm="syz-executor.1" name="anon_hugepage" dev="hugetlbfs" ino=816391 res=0 errno=0 00:12:05 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 12) 00:12:05 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2101}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:05 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 12) 00:12:05 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1d}, 0x48) 00:12:06 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 13) 00:12:06 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 14) 00:12:06 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2400}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) [ 2811.625505][ T28] audit: type=1804 audit(1655856726.030:189): pid=6172 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=add_template_measure cause=ENOMEM comm="syz-executor.1" name="anon_hugepage" dev="hugetlbfs" ino=816426 res=0 errno=0 00:12:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1e}, 0x48) 00:12:06 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:06 executing program 0: syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) (fail_nth: 14) 00:12:06 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 13) [ 2811.693828][ T28] audit: type=1804 audit(1655856726.100:190): pid=6179 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=add_template_measure cause=ENOMEM comm="syz-executor.3" name="anon_hugepage" dev="hugetlbfs" ino=815364 res=0 errno=0 00:12:06 executing program 5: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2403}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x21}, 0x48) 00:12:06 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:06 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 15) [ 2811.813964][ T28] audit: type=1804 audit(1655856726.220:191): pid=6188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=add_template_measure cause=ENOMEM comm="syz-executor.1" name="anon_hugepage" dev="hugetlbfs" ino=815374 res=0 errno=0 00:12:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x22}, 0x48) 00:12:06 executing program 4: getsockopt$CAN_RAW_FD_FRAMES(0xffffffffffffffff, 0x65, 0x5, 0x0, &(0x7f0000000080)) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_io_uring_setup(0x43c6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000180)) 00:12:06 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 16) [ 2811.832389][ T6196] ================================================================== [ 2811.832402][ T6196] BUG: KASAN: use-after-free in anon_vma_interval_tree_remove+0xc7d/0xf30 [ 2811.832434][ T6196] Read of size 8 at addr ffff88807ddb9728 by task syz-executor.0/6196 [ 2811.832453][ T6196] [ 2811.832458][ T6196] CPU: 1 PID: 6196 Comm: syz-executor.0 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2811.832481][ T6196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2811.832493][ T6196] Call Trace: 00:12:06 executing program 3: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) (fail_nth: 14) 00:12:06 executing program 1: mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7, 0x60872, 0xffffffffffffffff, 0x0) [ 2811.832500][ T6196] [ 2811.832507][ T6196] dump_stack_lvl+0xcd/0x134 [ 2811.832542][ T6196] print_report.cold+0x2ba/0x726 [ 2811.832604][ T6196] ? anon_vma_interval_tree_remove+0xc7d/0xf30 [ 2811.832628][ T6196] kasan_report+0xbe/0x1f0 [ 2811.832653][ T6196] ? anon_vma_interval_tree_remove+0xc7d/0xf30 [ 2811.832678][ T6196] anon_vma_interval_tree_remove+0xc7d/0xf30 [ 2811.832707][ T6196] ? mas_find+0x20d/0xce0 [ 2811.832743][ T6196] unlink_anon_vmas+0x218/0x840 [ 2811.832777][ T6196] free_pgtables+0x24d/0x420 [ 2811.832808][ T6196] ? free_pgd_range+0xbf0/0xbf0 [ 2811.832843][ T6196] exit_mmap+0x205/0x750 [ 2811.832868][ T6196] ? __ia32_sys_remap_file_pages+0x150/0x150 [ 2811.832907][ T6196] __mmput+0x128/0x4c0 [ 2811.832931][ T6196] mmput+0x5c/0x70 [ 2811.832953][ T6196] do_exit+0xa18/0x2a00 [ 2811.832971][ T6196] ? find_held_lock+0x2d/0x110 [ 2811.833005][ T6196] ? mm_update_next_owner+0x7b0/0x7b0 [ 2811.833037][ T6196] ? lock_downgrade+0x6e0/0x6e0 [ 2811.833061][ T6196] do_group_exit+0xd2/0x2f0 [ 2811.833081][ T6196] get_signal+0x2542/0x2600 [ 2811.833106][ T6196] ? futex_wake_mark+0x1a0/0x1a0 [ 2811.833131][ T6196] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 2811.833153][ T6196] ? exit_signals+0x8b0/0x8b0 [ 2811.833175][ T6196] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 2811.833200][ T6196] arch_do_signal_or_restart+0x82/0x2300 [ 2811.833233][ T6196] ? do_futex+0x12e/0x300 [ 2811.833261][ T6196] ? __ia32_sys_get_robust_list+0x3b0/0x3b0 [ 2811.833288][ T6196] ? get_sigframe_size+0x10/0x10 [ 2811.833321][ T6196] ? __x64_sys_futex+0x1b0/0x4a0 [ 2811.833347][ T6196] ? do_futex+0x300/0x300 [ 2811.833370][ T6196] ? exit_to_user_mode_prepare+0x137/0x250 [ 2811.833395][ T6196] exit_to_user_mode_prepare+0x15f/0x250 [ 2811.833418][ T6196] syscall_exit_to_user_mode+0x19/0x50 [ 2811.833451][ T6196] do_syscall_64+0x42/0xb0 [ 2811.833474][ T6196] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2811.833498][ T6196] RIP: 0033:0x7fec32c89109 [ 2811.833514][ T6196] Code: Unable to access opcode bytes at RIP 0x7fec32c890df. [ 2811.833523][ T6196] RSP: 002b:00007fec33d7b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 2811.833544][ T6196] RAX: 0000000000000001 RBX: 00007fec32d9bf68 RCX: 00007fec32c89109 [ 2811.833559][ T6196] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fec32d9bf6c [ 2811.833573][ T6196] RBP: 00007fec32d9bf60 R08: 00007ffd03b2c080 R09: 0000000000000000 [ 2811.833587][ T6196] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fec32d9bf6c [ 2811.833602][ T6196] R13: 00007ffd03b04a8f R14: 00007fec33d7b300 R15: 0000000000022000 [ 2811.833624][ T6196] [ 2811.833631][ T6196] [ 2811.833635][ T6196] Allocated by task 6196: [ 2811.833644][ T6196] kasan_save_stack+0x1e/0x40 [ 2811.833664][ T6196] __kasan_slab_alloc+0x90/0xc0 [ 2811.833684][ T6196] kmem_cache_alloc+0x280/0x4d0 [ 2811.833702][ T6196] vm_area_dup+0x81/0x380 [ 2811.833722][ T6196] copy_vma+0x36f/0x890 [ 2811.833743][ T6196] move_vma+0x449/0xf60 [ 2811.833765][ T6196] __do_sys_mremap+0x48a/0x16b0 [ 2811.833789][ T6196] do_syscall_64+0x35/0xb0 [ 2811.833811][ T6196] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2811.833831][ T6196] [ 2811.833834][ T6196] Freed by task 6196: [ 2811.833842][ T6196] kasan_save_stack+0x1e/0x40 [ 2811.833861][ T6196] kasan_set_track+0x21/0x30 [ 2811.833879][ T6196] kasan_set_free_info+0x20/0x30 [ 2811.833902][ T6196] ____kasan_slab_free+0x166/0x1c0 [ 2811.833922][ T6196] slab_free_freelist_hook+0x8b/0x1c0 [ 2811.833952][ T6196] kmem_cache_free+0xed/0x5b0 [ 2811.833969][ T6196] copy_vma+0x6ac/0x890 [ 2811.833990][ T6196] move_vma+0x449/0xf60 [ 2811.834012][ T6196] __do_sys_mremap+0x48a/0x16b0 [ 2811.834036][ T6196] do_syscall_64+0x35/0xb0 [ 2811.834057][ T6196] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2811.834078][ T6196] [ 2811.834081][ T6196] The buggy address belongs to the object at ffff88807ddb96c0 [ 2811.834081][ T6196] which belongs to the cache vm_area_struct of size 152 [ 2811.834097][ T6196] The buggy address is located 104 bytes inside of [ 2811.834097][ T6196] 152-byte region [ffff88807ddb96c0, ffff88807ddb9758) [ 2811.834116][ T6196] [ 2811.834120][ T6196] The buggy address belongs to the physical page: [ 2811.834126][ T6196] page:ffffea0001f76e40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7ddb9 [ 2811.834147][ T6196] memcg:ffff88805c84a801 [ 2811.834154][ T6196] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 2811.834181][ T6196] raw: 00fff00000000200 ffffea000170e800 dead000000000002 ffff888140006b40 [ 2811.834200][ T6196] raw: 0000000000000000 0000000000120012 00000001ffffffff ffff88805c84a801 [ 2811.834211][ T6196] page dumped because: kasan: bad access detected [ 2811.834220][ T6196] page_owner tracks the page as allocated [ 2811.834225][ T6196] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 3614, tgid 3614 (syz-executor.1), ts 2446832490257, free_ts 2446751849178 [ 2811.834263][ T6196] get_page_from_freelist+0x2043/0x3cf0 [ 2811.834289][ T6196] __alloc_pages+0x1c7/0x510 [ 2811.834312][ T6196] alloc_pages+0x1aa/0x310 [ 2811.834330][ T6196] allocate_slab+0x26c/0x3c0 [ 2811.834358][ T6196] ___slab_alloc+0x99f/0xe10 [ 2811.834386][ T6196] __slab_alloc.constprop.0+0x4d/0xa0 [ 2811.834430][ T6196] kmem_cache_alloc+0x3e6/0x4d0 [ 2811.834448][ T6196] vm_area_dup+0x81/0x380 [ 2811.834469][ T6196] dup_mmap+0x656/0x1090 [ 2811.834490][ T6196] dup_mm+0x91/0x370 [ 2811.834510][ T6196] copy_process+0x3ca8/0x7080 [ 2811.834532][ T6196] kernel_clone+0xe7/0xab0 [ 2811.834555][ T6196] __do_sys_clone+0xba/0x100 [ 2811.834577][ T6196] do_syscall_64+0x35/0xb0 [ 2811.834599][ T6196] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2811.834620][ T6196] page last free stack trace: [ 2811.834625][ T6196] free_pcp_prepare+0x549/0xd20 [ 2811.834646][ T6196] free_unref_page_list+0x17e/0x14f0 [ 2811.834670][ T6196] release_pages+0xbe3/0x13d0 [ 2811.834696][ T6196] tlb_batch_pages_flush+0xa8/0x1a0 [ 2811.834720][ T6196] tlb_finish_mmu+0x147/0x7e0 [ 2811.834743][ T6196] exit_mmap+0x217/0x750 [ 2811.834763][ T6196] __mmput+0x128/0x4c0 [ 2811.834782][ T6196] mmput+0x5c/0x70 [ 2811.834801][ T6196] do_exit+0xa18/0x2a00 [ 2811.834816][ T6196] do_group_exit+0xd2/0x2f0 [ 2811.834833][ T6196] get_signal+0x2542/0x2600 [ 2811.834851][ T6196] arch_do_signal_or_restart+0x82/0x2300 [ 2811.834880][ T6196] exit_to_user_mode_prepare+0x15f/0x250 [ 2811.834900][ T6196] syscall_exit_to_user_mode+0x19/0x50 [ 2811.834928][ T6196] do_syscall_64+0x42/0xb0 [ 2811.834950][ T6196] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2811.834971][ T6196] [ 2811.834974][ T6196] Memory state around the buggy address: [ 2811.834983][ T6196] ffff88807ddb9600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2811.834997][ T6196] ffff88807ddb9680: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 2811.835011][ T6196] >ffff88807ddb9700: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc [ 2811.835021][ T6196] ^ [ 2811.835030][ T6196] ffff88807ddb9780: fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2811.835044][ T6196] ffff88807ddb9800: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 [ 2811.835054][ T6196] ================================================================== [ 2811.852413][ T28] audit: type=1804 audit(1655856726.260:192): pid=6194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=add_template_measure cause=ENOMEM comm="syz-executor.3" name="anon_hugepage" dev="hugetlbfs" ino=815384 res=0 errno=0 [ 2811.872728][ T6196] Kernel panic - not syncing: panic_on_warn set ... [ 2811.872754][ T6196] CPU: 0 PID: 6196 Comm: syz-executor.0 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2811.872780][ T6196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2811.872792][ T6196] Call Trace: [ 2811.872799][ T6196] [ 2811.872807][ T6196] dump_stack_lvl+0xcd/0x134 [ 2811.872848][ T6196] panic+0x2d7/0x64a [ 2811.872912][ T6196] ? panic_print_sys_info.part.0+0x10b/0x10b [ 2811.872946][ T6196] ? preempt_schedule_common+0x59/0xc0 [ 2811.872977][ T6196] ? preempt_schedule_thunk+0x16/0x18 [ 2811.873011][ T6196] ? anon_vma_interval_tree_remove+0xc7d/0xf30 [ 2811.873039][ T6196] end_report.part.0+0x3f/0x7c [ 2811.873071][ T6196] kasan_report.cold+0x8/0x12 [ 2811.873105][ T6196] ? anon_vma_interval_tree_remove+0xc7d/0xf30 [ 2811.873132][ T6196] anon_vma_interval_tree_remove+0xc7d/0xf30 [ 2811.873160][ T6196] ? mas_find+0x20d/0xce0 [ 2811.873189][ T6196] unlink_anon_vmas+0x218/0x840 [ 2811.873226][ T6196] free_pgtables+0x24d/0x420 [ 2811.873257][ T6196] ? free_pgd_range+0xbf0/0xbf0 [ 2811.873295][ T6196] exit_mmap+0x205/0x750 [ 2811.873320][ T6196] ? __ia32_sys_remap_file_pages+0x150/0x150 [ 2811.873360][ T6196] __mmput+0x128/0x4c0 [ 2811.873384][ T6196] mmput+0x5c/0x70 [ 2811.873405][ T6196] do_exit+0xa18/0x2a00 [ 2811.873423][ T6196] ? find_held_lock+0x2d/0x110 [ 2811.873457][ T6196] ? mm_update_next_owner+0x7b0/0x7b0 [ 2811.873488][ T6196] ? lock_downgrade+0x6e0/0x6e0 [ 2811.873513][ T6196] do_group_exit+0xd2/0x2f0 [ 2811.873535][ T6196] get_signal+0x2542/0x2600 [ 2811.873561][ T6196] ? futex_wake_mark+0x1a0/0x1a0 [ 2811.873585][ T6196] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 2811.873609][ T6196] ? exit_signals+0x8b0/0x8b0 [ 2811.873630][ T6196] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 2811.873654][ T6196] arch_do_signal_or_restart+0x82/0x2300 [ 2811.873688][ T6196] ? do_futex+0x12e/0x300 [ 2811.873713][ T6196] ? __ia32_sys_get_robust_list+0x3b0/0x3b0 [ 2811.873742][ T6196] ? get_sigframe_size+0x10/0x10 [ 2811.873782][ T6196] ? __x64_sys_futex+0x1b0/0x4a0 [ 2811.873810][ T6196] ? do_futex+0x300/0x300 [ 2811.873835][ T6196] ? exit_to_user_mode_prepare+0x137/0x250 [ 2811.873864][ T6196] exit_to_user_mode_prepare+0x15f/0x250 [ 2811.873889][ T6196] syscall_exit_to_user_mode+0x19/0x50 [ 2811.873924][ T6196] do_syscall_64+0x42/0xb0 [ 2811.873951][ T6196] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2811.873977][ T6196] RIP: 0033:0x7fec32c89109 [ 2811.873994][ T6196] Code: Unable to access opcode bytes at RIP 0x7fec32c890df. [ 2811.874005][ T6196] RSP: 002b:00007fec33d7b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 2811.874027][ T6196] RAX: 0000000000000001 RBX: 00007fec32d9bf68 RCX: 00007fec32c89109 [ 2811.874042][ T6196] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fec32d9bf6c [ 2811.874057][ T6196] RBP: 00007fec32d9bf60 R08: 00007ffd03b2c080 R09: 0000000000000000 [ 2811.874072][ T6196] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007fec32d9bf6c [ 2811.874087][ T6196] R13: 00007ffd03b04a8f R14: 00007fec33d7b300 R15: 0000000000022000 [ 2811.874111][ T6196] [ 2811.965335][ T28] audit: type=1804 audit(1655856726.370:193): pid=6204 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=add_template_measure cause=ENOMEM comm="syz-executor.1" name="anon_hugepage" dev="hugetlbfs" ino=816512 res=0 errno=0 [ 2812.026458][ T6208] FAULT_INJECTION: forcing a failure. [ 2812.026458][ T6208] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2812.026538][ T6208] CPU: 1 PID: 6208 Comm: syz-executor.1 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 [ 2812.026565][ T6208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2812.026579][ T6208] Call Trace: [ 2812.026586][ T6208] [ 2812.026595][ T6208] dump_stack_lvl+0xcd/0x134 [ 2812.026641][ T6208] should_fail.cold+0x5/0xa [ 2812.026678][ T6208] _copy_to_user+0x2a/0x140 [ 2812.026715][ T6208] simple_read_from_buffer+0xcc/0x160 [ 2812.026744][ T6208] proc_fail_nth_read+0x187/0x220 [ 2812.026771][ T6208] ? proc_exe_link+0x1d0/0x1d0 [ 2812.026795][ T6208] ? security_file_permission+0xab/0xd0 [ 2812.026827][ T6208] ? proc_exe_link+0x1d0/0x1d0 [ 2812.026851][ T6208] vfs_read+0x1ef/0x5d0 [ 2812.026879][ T6208] ksys_read+0x127/0x250 [ 2812.026903][ T6208] ? vfs_write+0xac0/0xac0 [ 2812.026927][ T6208] ? syscall_enter_from_user_mode+0x22/0xb0 [ 2812.026969][ T6208] do_syscall_64+0x35/0xb0 [ 2812.026997][ T6208] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 2812.027022][ T6208] RIP: 0033:0x7f564723bcbc [ 2812.027041][ T6208] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2812.027064][ T6208] RSP: 002b:00007f56484c8160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2812.027087][ T6208] RAX: ffffffffffffffda RBX: 00007f564739bf60 RCX: 00007f564723bcbc [ 2812.027103][ T6208] RDX: 000000000000000f RSI: 00007f56484c81e0 RDI: 0000000000000003 [ 2812.027118][ T6208] RBP: 00007f56484c81d0 R08: 0000000000000000 R09: 0000000000000000 [ 2812.027134][ T6208] R10: 0000000000060872 R11: 0000000000000246 R12: 0000000000000002 [ 2812.027148][ T6208] R13: 00007fff37a200cf R14: 00007f56484c8300 R15: 0000000000022000 [ 2812.027181][ T6208] [ 2812.282161][ T28] audit: type=1804 audit(1655856726.690:194): pid=6218 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=add_template_measure cause=ENOMEM comm="syz-executor.3" name="anon_hugepage" dev="hugetlbfs" ino=816570 res=0 errno=0 [ 2813.214057][ T6196] Kernel Offset: disabled [ 2813.218384][ T6196] Rebooting in 86400 seconds..