62817e08e38b18ed3ba4cb610d34b460e977204a01ac19b93d9e67ecaf6a74a434e0396fa5c6ba7eacc144419cf604cb7400a7a59948d8ec2058aaf035bbe7f2cac055dc48c557ee4cf19967f0f995a24724f88fce64dfe6184a87e872dc9d6e95e2d9ac07c3d30c353251b420e201cb2e43d515603f0d60078df5eb22cad8325f5068b2251b4136f32dc76740fa3f2e49b8c22c18427cfe84e22db057d95454557d1a0398b4cb05b2dc0f959f356b057d0a8bd54a8e193c741b60663a6890c54757c4faf6697743f98c693b25ecd31475bd5595e200f9775db82d572512af971e30d546c9c8edce789a02dfe0c3ae41eb7976f4e09253f4429aa0235932e2430572c8e8ac030ecffe7602b00de2b5e6ec1678dac6d7ec3310a3ff2b70c5c83e15655531ce7fb7ed63ee96979884ba7481522bbda42c4b744811ae36862f382d49338f198b583caa2c6286edd7e71db8f12b327c99dc2d2b6af3cdaa9e739deeb56b80d7827686d804084ed09245d0bc10c5d1554aff31a777f1dd840e74738c133ed9ae7a0f0c8845dc1b92d754b19f73d914feb1c3cc4d3f04319eaedb91a131ba3ed01e29cd8809775b2cf5d6bce2e8306a34af61e5aedc8202a86c0b176d80626f77702aa5ef6a4b7bf4342ac7ff58de7769ab907c7492f5c6d901f49596337776911c1947eba15f9cbdae4e6fb6a26e05c9a5a48fa70a0081ddb7280d6a3fe352a4787aa2a91c512d7b3a88b24cbd62d80376f3c169eb5a0803848f7b806ce2627b838a8b595198a4dffaac29ae5e00830c91b0eda04529ba1682fd4079733fda35bf29f1e3f9ff792dc38574304dab3748906141b7f7b28bb6d3a4da7f3a70341608b1c968cf3655dadf53d48666d6b581849c30c4776bf4fe3a06ea049c4935761c047ddd69bb33797a133fe88cbbe473f753fc2ce0efcd504dbf477b60c9b55dc309b2193fd86c2297437dd9c62a490c34fd10e5d29060cd09934552c4c2dd72f7836e1be02e37228b6ed745b05678d0b67d8bac7c60369dbe0c5c2650c0909c85ecc76fa15a5c07d44023de4ff6a48ed39918cccece0ff49702a3c434bd719d7d71a942831a962112222d8b74cbb89d3292b717c57cb868e3ca4df9a3825cce6ded36bbf654952def57a3f03dc278457c7c01e8117ef0caf2a94347de34464dd47e7f653b47099ada303f2bf3ea33bbc7121e347d9a23d35fa5c979a21593e34b9e31402dfa629898898ac695b24afbedf5e5da0ccf61c5a0a791eaecbb0884013c8994b30d028d83f47a6b57c706d9a36879c6ef17f2baa9b240891b1cd470cb34fd298f67dda4386a7838a792454f39f0341d0d0c830a96353233444701cb83bbd615ee2061f213d94f551895172772282ae50dbeb34597fffaeb848a05f3dfc206d08997f30ef26fabcf0064be425f523a0673d2f80be266e255988dc6c3b8a121214329fb05cb53e58cf49ff221ff631f86c485c2032c2990aeeee44229c8d88122624071ec92aacaa5d71aeb085fe962c9b0bc2e972285edd768b353945fc468a347ae3c9e196160e6b6e4fdecf164258966bc24c0c2e89a7e0e468eac366abc3a86ab155d5b11f186dc7b1909d60d081c9a35fde7271409f7a9f72ece85784e3673b0af5b72c956f0ea70c89934efdccfbd6d24848ac36eeeaa32fcc503954b72c66844b6401de28e34536465d10debf5db1a1db14912eab2a8dba84e010359045362e6625d6abc9809f9c98668b4804d81e21f9cf9fddeec9e4e0c342cef0593a140372d59d7e787a668fefd46dcefe6c057e840ce39eb0b98b5c1824b116c79dfdff5904e603fa97fe29afbc0c986f3b1a4f7059810a6aa4ed211e9a46d7e00b4fba84d72046f410566b4f8a65385fd8299de2ff8efd11a6567b771f5265803230dc302d846633dcd0c42272d7790367257a2d3a1bd2694a428817b5e9aa6a9a3fddd37e3f0740f4ac6e3c13eed8181b73e13f828a80a9508394986f70dc8fe713063ed3ecb0447b9213daa4a87615fb5637ba205b611342431bd9c17b3551716c708feb5caee62d8deedc4d822c9c90ce93ca45b099685a4c737af03034d19ef3eb2b63ad4d97f64f3d79643e6de65d4b428860aef55a854117dcac2f148335b836fa290746935b4a527b09ca5b6f5aa94fae0e0996003a37bd9ca3143057e4e9efc20ab4672929ede05fb73802e798563ea8bc6819484f081ae1eb797de741413970bdfe866be3f66f98312ce538bbe67413f4c6deff4cb0a5993bbac240f9575a7d09fa4bfd17e24a917c32f2dccd61c18a668bb9bfcca94cffac84e98d4606d5c6d27864a1b33964981de7e206b2e66000a61739e62f38cf0ac99c010e3c2282aa6a2f24ee1aff442a96f59d779bb9fc786722ca26cfb0db69c6eb32aa90df1029403669dc718221eae013c3cbbd43b88cae64f49fda9668b242e945d5074224797b54d907300bdd10ebc0c1fe84fed26daca43cb827792c15c0f921c511683109a5060df40181cabb2ba9ec006a17f08fa65ff631367b06b2b45e7177d5eef4a3afdc327955607e0aad71d38e1986c4f453295f81b6e462d06ffcc8582dc6cc548f682199d7eba0716d237e45f5733af9009bdd4050c4c9b25731862f4ccf6959a1634f4955cc9079f70aa93e5677db6760a8ab0588740a7f5292fa90daccbad6706a8641bdf649090c34f424a785873f57ecd3099ed4580edef5d7ed567d7b4720ed1b5a4c8a78596001fbe927da1582395740cb449676537cfc85cfb867fa29fcdd66970793d34e413fee99c00b0c4a35229fa41ef9a9e7c49a7e6e0b8b2736bbb5a5e93c48c28c912b016148e881b7040c0e299ac4a43c91c850b9118b3db64a5cf8b85a4b43d0ce371f1d2b59126155061940471d5b9c2650fb6d7cea97dbec554613bf25575434e0fb024669a93a6449449cb5d8db7e4ae2537281f4b2389190c155d0f45dd70ecdd32593605f2cf374b2b6eaffc85ca081b6a3fe3c6d5400572f288aa34fc37ca2a0d0d89c6d6753477379810359339e37528e283639e62bc7d1c4e378c3c1a7658a92e70975673e89b2c559d8d824727a2c4565d0f6352dee48c70ffe6c892bc42e83d3da81601dffdc580ae223b4043242e53082572f7c755458bd9f37e2967fc9532179f250a5b69d334044938fd33acd34a095d1eec2a9c442ed8391c7dfa6a131446b9bdd4df5abd5220b439c1892294d93db92ebe628ea2928deef3b223f3fec631e03a4d91473b86925a51abc00d1affc3b726297bed29ad279084baffa2ca8a135673640d0e510aa27d79a4d8ab5f2547ae3149f3d4084a882f9c74f0cd0e86154525edcde58e8cf0d1a1ec02082f48dd469f4230178b448a5aae3f69c9220bbeecc13b3f68865a391560411fe2a76bfcd301d4385b0d8e9ff1e06b561c56c04ed3a9d0f8b5998a9564923be7fbda869a36df4cf60238aa0fa5a4557f0c021b8a0ca06c0fb3e999bd9b0b3caa1e37b433d3432d35d493224ab6c2abead70a95d1be9b7c8177adcdcc80e8a759100a41fec5072cb3c084b29895dafc4c75f64ba27d539cb95b35327358270bda793f7aecfa2ccba594fe86f9a54b39e147b4117a95dcc4326f42ebf9f326c37b80ee8546d3800724fbb8b5c4c73e65aaa9a91bb0885b7853762f1948c50ccd62e583833c86c22fbe6ca21597ca478b54efbfedad621e7109d66db594ccf8b8f9fc5f273af0aacabd586a33412ddd845df4dbe4da035cf0a4c51bfd1a441d144e1fa1f0b43caa868fa1a479afaf59ae51cf070d058f7a456982276a1c57d58e918d44760b715cc3dd0d13a8cf72d47e181955108b8d0617982170e8a6946fac70e94ce6e2604da5df023c94ceb9d2d666b72cc07b0a4978a46d6ca458deefa52112ba8ef96f2158fa9ec6e459089a5e00023f7ad95438efc7df15223f1bdc019f10cc545b06cf318146cb34183cebe34ec2b67d2302fb0bc96b15ada835e68e5d0f9bbc36ec8ca41a77fa1bde781c8ec010b306256bdddb70f72fbdfefcc471117df4b378ce74851498a408526443073775faca3df95ba2897bbec3c9d18cd1ade9c9fca6dc208000ab68fba3887f1babf8c39007743e3c12f9dffd8d92d99d9278f49e9c012dd8decd72438d9efe1cb719aab44628a0b895e0ac47f62954325ab0f54ebb36d86d1a72ccb09ab8cbc65c9f145abc315f2aa86c990379715fd787476132572bd0362e2366fb4355d4d87592f50bd2a39b8c0e665c75aa2efbf2b90d2228947cdf82d4b2fb0c95394945c177d30861a240190d93295b48ec43825ada88dab0b8a12ff1008a25c7e4715c0ea12c5661fb73dee46bdf89cf247995028577ea51673031e05d8d60636ae0d06668a56c7bd1690e1cc744c69cc720769fca52b1cb2c98919bf5a9c852d8f911e708c99630cb6b2ee049ca1860796f1d8077f0e6c469c501368802b769140a6d1862fa449283a152f0429762eeca4cfa9c9a7e0963887c6237caaea3c4ccf783473c93a427f879814e0ee6bb099a6c61013a9de73a08585f2438f644113db4a822199ea2b0daa8e2448727607c9370c5c2bcc64e4b67fb1d82139fda3157f6bdcc622c3c36b31b74fb4a21803f606922f81682aa477d2a2b2eb2df0b2503dd4cc2c01b28b80ec24904fb1d17636bc8dbd306eedf7abd651d", 0x1000}, {&(0x7f0000000000)="f9ce1d6b5c9bafeb1368b6cf395062e931ba3790e1455a870eb7aea052e020ffad42a2fadf4d2e46f2f49adfd59e4c02e53e531002e320f69fdb9c2a", 0x3c}, {&(0x7f0000000180)="ac9ecf37262078de442b05041c6070b117e9e42fda9822b35d249c00fced74ac7ee3544c5dbee037f513e9c0748f6c4c35aaed4fa3687db41f30301f27bbcaea5e76da0b590c0b4fa0a4754164ec5a6787aca0893e09003bf00b739c7e8e1af316391f4ca1a3d7fb04dae096aae2dbe2fbbf159e0e6291eb16457fd05aa88ead82cbe9fbaf1cbe854ccec38aa30e1662102d6d0af58835c101c93d648bfa426e8dae1e3e7c213ca2cbc9d3e735c00cdbf9d534793637fcb70ed75e917cddbbd0acb7cf2f31247ae761aa10dae80e89c024b56a2ef5f3a4fde2423e38ecfe5db65d2c", 0xe2}], 0x3, 0xfff)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
r2 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0xd25, 0x900)
connect$pptp(r2, &(0x7f0000000280)={0x18, 0x2, {0x3, @loopback}}, 0x1e)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:32 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x0, 0x0)
r2 = open(&(0x7f0000000300)='./bus\x00', 0x0, 0x0)
getdents(r2, 0x0, 0x0)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00')
sendmsg$NL80211_CMD_GET_INTERFACE(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x34, r3, 0x402, 0x70bd28, 0x25dfdbfd, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x80000000, 0x4}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0xffffffffffffffff}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0xc880)
sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, r3, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_TYPE={0x8}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "64d3d544db"}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x1}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20}, 0x8000)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r4, 0x81785501, &(0x7f0000000340)=""/175)
ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f0000000000)={0x1e3, 0x7ff})

15:50:32 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4}, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="85e541f4000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a1a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079180008077beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adc8fd897a1163edefba0868942577d8953191eeb79379829652b10737d4e25a22695df5cff25340af4fc990000099ffd70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b395a1ee9125db3bd07ad3f49a86046f63b16e8ebdf611e40785465ae2e0fbbe4a5eff4aa7416bb6a49f38a8f54fd052bddcaa4a31a99097bbd3bd2df6557d39b036c1714a48580e38a2a11bbfe56229ef45e9213e3226c8025229b68e3a77e94f98d47a0000000000000000ef32a1d8348f2a2878f9e3d911b8d2ef167c38c82e524588c19d19390719193c90314a73e7430c7c709e3fd704198c4e679ac8c0833c030462b9dca9282bec9b3d9e1fb74b95e298932da90b46b5f70927be114866016e0d95d8cf23ac36c9c0bd75cd94fc1b19b71502dfd6f8de02"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x4000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x4000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000240)='/dev/btrfs-control\x00', 0x2000, 0x0)
write$P9_RMKDIR(r4, &(0x7f00000002c0)={0xfffffffffffffd83, 0x49, 0x1, {0x0, 0x1, 0x3}}, 0x14)
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)
ioctl$VIDIOC_SUBDEV_G_CROP(r1, 0xc038563b, &(0x7f0000000300)={0x1, 0x0, {0x7, 0x6, 0xfff, 0xbcf}})

15:50:32 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x80000)
ioctl$HIDIOCSFEATURE(r0, 0xc0404806, &(0x7f0000000180)="b1d36e6ef891ffe1b562181609b02262af58b5dd0aac58b313925cbb6f3d6ac1af5499eeab4c0d14116103030f43e7d098084c40c40d1f04f29097cba574ad2b63610913487ed7c62e4184cb97720585902b50235d0c0c69a058a4b0a0857fa18a8ee55858")
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x280, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1824.525468][T19846] ubi0: background thread "ubi_bgt0d" started, PID 19846
[ 1824.536270][T19842] ubi: mtd0 is already attached to ubi0
[ 1825.454368][T19865] ubi: mtd0 is already attached to ubi0
[ 1825.548252][T19864] ubi0: detaching mtd0
15:50:32 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaa1c9a01802bf500180000000000739078ac1e0001ffffffff03000000000000000000"], 0x0)

15:50:33 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f0000000140)=0x3)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r4 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r4, 0x0, 0x0)
bind$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x2, @none, 0x101}, 0xe)
ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e)
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r5, 0x40046f41, 0x76006e)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f00000003c0)=0x1, 0x4)
ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000300)={0x4, 0x0, [{0x2000, 0x0, &(0x7f0000000040)}, {0xf000, 0x8, &(0x7f00000000c0)=""/8}, {0x1, 0xbb, &(0x7f00000001c0)=""/187}, {0xe002, 0x5b, &(0x7f0000000280)=""/91}]})
ioctl$DRM_IOCTL_AGP_ACQUIRE(r5, 0x6430)

[ 1825.700962][T19864] ubi0: mtd0 is detached
[ 1825.742645][T19874] ubi0: attaching mtd0
[ 1825.764478][T19874] ubi0: scanning is finished
15:50:33 executing program 2:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000000c0)=@security={'security\x00', 0xe, 0x4, 0x4f0, 0xffffffff, 0x298, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x420, 0x420, 0x420, 0xffffffff, 0x4, &(0x7f0000000080), {[{{@uncond, 0x0, 0x100, 0x140, 0x0, {}, [@common=@hl={{0x28, 'hl\x00'}, {0x0, 0x81}}, @common=@frag={{0x30, 'frag\x00'}, {[0x6, 0x9a3d], 0x0, 0x24, 0x3}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x6, 0x10, "109cf80aeadaec2fe03788108517e7d868cac1be5d6955947cc3106e9320"}}}, {{@ipv6={@dev={0xfe, 0x80, [], 0x29}, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [0xffffff00, 0xff000000], [0xffffffff, 0x0, 0xffffff00, 0xff000000], 'ipvlan0\x00', 'veth0_to_bond\x00', {}, {}, 0x87, 0x8, 0x5, 0x4}, 0x0, 0x118, 0x158, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x3, "1078", 0x1}}, @common=@hbh={{0x48, 'hbh\x00'}, {0x2, 0x0, 0x0, [0x8a, 0x3, 0x2, 0x3ff, 0x9, 0xa6, 0x2, 0x13, 0x800, 0x7, 0x20, 0x3, 0x0, 0xd7, 0xa395, 0x9], 0xc}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x1, 0x14, "d73385d9db5b0847f492cfaed95a5c278a9eb9ad4310aebcdf76442be6d3"}}}, {{@uncond, 0x0, 0x160, 0x188, 0x0, {}, [@common=@srh1={{0x90, 'srh\x00'}, {0xff, 0x20, 0xff, 0x1, 0xc149, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @empty, @empty, [0xffffff00, 0x0, 0x0, 0xff], [0xffffffff, 0xff], [0xff, 0xff, 0xffffffff], 0x200, 0x2008}}, @common=@eui64={{0x28, 'eui64\x00'}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x550)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
io_setup(0xa, &(0x7f0000000080)=<r2=>0x0)
r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
io_submit(r2, 0x1, &(0x7f0000000200)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000100)="e0", 0x1}])
io_destroy(r2)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
r4 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
r5 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r6=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r6}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000040)={r6, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000640)={r6, 0x2}, &(0x7f0000000680)=0x8)
openat$audio1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio1\x00', 0x20000, 0x0)
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

15:50:33 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000180)=""/210)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:33 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000003c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1825.948497][T19874] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1825.992414][T19874] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1826.042363][T19874] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1826.087205][T19874] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1826.116989][T19874] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1826.145885][T19874] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1826.173796][T19874] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1826.209102][T19874] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
15:50:33 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e766601a01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1826.247977][T19894] ubi0: background thread "ubi_bgt0d" started, PID 19894
[ 1826.248041][T19891] ubi0: detaching mtd0
[ 1826.250296][T19891] ubi0: mtd0 is detached
[ 1826.263146][T19903] ubi0: attaching mtd0
[ 1826.263859][T19903] ubi0: scanning is finished
[ 1826.443887][T19903] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1826.559768][T19921] ubi0: attaching mtd0
[ 1826.583363][T19921] ubi0: scanning is finished
[ 1826.729633][T19921] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1826.729752][T19921] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1826.729813][T19921] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1826.729859][T19921] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1826.730106][T19921] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1826.730212][T19921] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1826.730310][T19921] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1826.730415][T19921] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1826.731175][T19922] ubi0: detaching mtd0
[ 1826.733060][T19922] ubi0: mtd0 is detached
[ 1826.733188][T19924] ubi0: attaching mtd0
[ 1826.733895][T19924] ubi0: scanning is finished
[ 1826.819510][T19924] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1826.819528][T19924] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1826.819539][T19924] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1826.819550][T19924] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1826.819562][T19924] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1826.819573][T19924] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1826.819597][T19924] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1826.819609][T19924] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
15:50:34 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f1543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb7937982695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa000000000000000000"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:34 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
sendmmsg(r1, &(0x7f0000004f00)=[{{&(0x7f0000000180)=@vsock={0x28, 0x0, 0x2710}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000040)="6baf81fcca79c8e78e969533f8ac615f661867128371d11c560ac1aff3b24ec7fd310831497101ae7630", 0x2a}, {&(0x7f0000000200)="61cf17a70ce26a83540c3344386e56a01af04114160427c06b400d573aba81027bb66f8470ffeea4ce20dfb88b6560ef8a89c0a786c923e916f4a5dacbdb4fff6185802d49431a301cf8ca31d72e2c288e83f45915380abbded6fe5c92d4d787cb3dc9936444570b4daeed59937a167ade226d3eee7d9d9cea63baf16d1f8265021b4dd37ec6860b9073deb9dd016692530705d0", 0x94}, {&(0x7f00000003c0)="e6edb4d4752f3e4184d2e5b95d040551ce0785125abd455fd5022558041174f453b542b6162c6dcb86c3feeaf34a63f100e2adfc1252ba25e45304bd758596882a2e13e20523fdcefe8d0fecc090263746ee3eed1854dcbd5fdc28b9fdd878319b19dcdeda3137560e017550b68ee5a02b29453a6a9919b09785c02ef9585a890003bd61834273792f8c70e67ad772db315d4f29f6761cc5e687b90529de46e1e46bb6ae1db23dce47a38ec84049b31862600efb2031d95d947865bbb7e947d74be25c80002540c1ad929f894a3b45eaf31bbb55400063c5bd37d8ab", 0xdc}, {&(0x7f00000002c0)='C', 0x1}, {&(0x7f00000004c0)="f684a4590876470355d5c838d5d44997403095d016e2ae8e9c71b2c1f5b4f7f3cb58e29c0df1f34644a6fcb40bf2447d8ba0da4163e9c7a31524cc2ca6c04d4e4fde80ec8747b3094a8edda95b8e10a075feb0de8b9d612aaec54c4beb0f08310638d3b95286f5a30a181e8f58771527a13f51296827f20a7917e78cca6b3f42b517142d84d2f9da582f6a0ae1c01259b40e7e6aadfc0498b5ba33c0aaaaabe7a235e09977090603ac204793915660afe5d26854a31042b6dc95fcd33d55f9", 0xbf}, {&(0x7f0000000580)="8ba9157147e6201e90f0c953b5870db8de613080956a8cf9487afd8a630e842b42e16ebe64900dc89954ca2b5716a0b86f7be0dc9ed4b39f4e62055534281290fb82664173a65d1b090ca61224657782ea0448930008abdb9fec21ecc8ef710b0ce4cf78672ebce6b4cdf112adc125a2860ec49b75e7a059de0770eac942d91e75b2c92e2690367a692338f36f3ba7e2599666656a2047390c7a4646f2ca91e21d33438eb8aefe2d8bd2577b82e6eae43a394ba58dfa73b951fb75452be99cd0", 0xc0}, {&(0x7f0000000640)="3b0dab677d1c385bd2f1519c735d740286f852de6aa45e5d9702c96fe17b4af070faef8c001e24c18d57a8faf5ef057dcb0dc47831b6d0bdc06a42b509cf3752301f2f776cbc331a2b94e65d329c4808f29a01e4f896c18ce23094623ff0347032f5e5201bdee9a626d09e791d45f379f47f938a66232354cee8b89ae32ce9aa6d4d844e8b122a9462a55d1e88acc069eefb79cf3b61ebf111c8d2822abfb84bec22c848f48fb74e82fac310a2", 0xad}, {&(0x7f0000000700)="48de23e6a62d8c18d46f2dc24ae347bc573afe32dc9ec8fa8ba51f83da823b6f0006d29b547bad27bdb365c04b3c610dae69bff51071e14e90dd32fb26b33415f21d551fb1ef80874f6f4e3ecc80472a3fecd1a0706e5deeb9c3b78a7711e17c75de22d033aac3f9a92040301c5fe4bbb58f43e1bc13ffed6d", 0x79}, {&(0x7f0000000780)="20bf07e8519ba9b4d84c0934c9be5ee0cdae428b726e18dd97c00f47d3e70b820632385e453a98465ff9869e596e4afe715f201b01ccf2304e0377829f3be4a2e0a99d3175cbab9f54db8993510e72d359b6bcfd7ff82bb3d1f9b479b57dcd8b0238cffaed24291a4a5f50808da7831da932c232b0d41b97602c2a3fa698d68b618bf039e156aec1916f8d42b2917eef53845428ddd8ebec80faf8b770eb10e532c6c3245a2bee9e803ea31d2fb3b8af7e5de97ce3a764eda56121bf4c232ae8ab5084f40db614", 0xc7}], 0x9}}, {{&(0x7f0000000940)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x0, 0x0, 0x2, 0x2, {0xa, 0x4e20, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3}}}, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000300)="d5d77ced365a45e038c85ae4530395a0009ad640aba484b6b0a8421b06fae7196de1d12f9336", 0x26}, {&(0x7f00000009c0)="83db0099e0736cf0a2166398545990ab0abd5be562a61454ab5dd4ad600f8568abc61e2b990e2b6457acbd799d16ebf90868c35f34870b44715d69a1b774e3f732d75a398aff1a1d9c96d67e797b147404b6baf23ab4ccb1b9142e22b90d6f3bfa167c96fc232fc677caa07b15b412500a9c3447fd48a87062510fa34fc69f2985f3121b713172df7a79b1aad206c28cd2415c3fc6d7785c769f4e915232881ea654a7649c7116d5ff082b4c4b15c8da90f1237185cb8aa00780696097", 0xbd}, {&(0x7f0000000a80)="d3ded40c979c1e9e5968c947726aeed77f77583a99da1775a16a18e77fa06acea5145febc073b3e6cbe8eecf85ea221233ee0e1869f5b3f51f4bc5c032f3f304ef75c2633139d4eb0e51408d81f0182a47faece11556528ec1d6c12692fd79d0db", 0x61}, {&(0x7f0000000b00)="a1173657356770d49bce46fd2fcc862613eaaad41930f9c7ad66d549dad61605eaa6f52321081e78e98b5bef7a390a9398d03ab364fb905d1dd3e95e727615", 0x3f}, {&(0x7f0000000b40)="80bfe20817a6a4584854dedbbf19c771efda66cba5290e66c385246453f0447d41d423344bc31c04446db4872be1165f559bf9c5d9012a60ad46aa7b", 0x3c}], 0x5, &(0x7f0000000c00)=[{0xc0, 0x10f, 0x401, "07e0989d7dc7c5979178b88efda746cae376779962a4758c877b621807a1124705a59831f2c70c3dd9a76d65a11ea686fed441b77d817b6247cb3aa6cbc395b65064e4dfcd2ac78160e4819c9c6a71503bfa91c5e6158d31f4c9a653660488f5b4510746d16061168dc91fd539edb5004624c6f1b85d672bfb2da3ddfbe241f365dae289c7ed0ed3239dcb1a7b060e58142089bcb4ea44ab59db9d4b63177e8cf6dc11ed0314d7f5519c"}, {0xc8, 0x14, 0x8000, "ad7ef41cce5c788122902b1cb7b678b52ac0f41bfd075828f3d6468724444240fa60ccede7c3877850c1b2318dd5033800fc77450fc1b6e1307cf131d043527d3ed4b2fc646eadd23e2965a822f985864035c574269ddcbccc443e8f380c8d6da14eb2e3fe2a73c041d307c79b2aca28b8302605592116c9a3d14186ef837a74282df0e7e23e9b182fd9f81bb1d81e6d2eea69e95eb40055f6a32ad0adac30976477fa6373ac7f5d4f861c0d9a55605c56c8d766cac0e8"}, {0x40, 0x3a, 0x1, "5881bea1082dfed243e2ad4348ca875552509a563cadb9f6c1f222b53d8e3afd662d897e6fa90a90701a0d903f"}], 0x1c8}}, {{&(0x7f0000000e00)=@isdn={0x22, 0xff, 0x1, 0x7, 0x4}, 0x80, &(0x7f0000000f40)=[{&(0x7f0000000e80)="ee26e2307e591c390dfd90b879c6928d8c5146fb27f0c0a1231a43d3c7ef7680ebf2a915443ba204ecae2e6d73e3bb4f06bf8f94ef76b04fa259861be3e1edc12e6025679d4728123f7cea53fe0b6dbfc89dddcf9413a13440654eaba7ab0a35621bf33026731637ef6ff10115f73b135f47cf6d26e5ae303b37761f3ecb065ff0aedb216ed76c5a00b0", 0x8a}], 0x1}}, {{&(0x7f0000000f80)=@phonet={0x23, 0x1a, 0x95, 0x76}, 0x80, &(0x7f0000001180)=[{&(0x7f0000001000)="02c512a489fc6d68fd6810dc0c62f2db6b71ad93714d3adca86a976c0299393b238490469d7e897807dd80d8ba36306881042f19db438fbf1faede76f7f8f37094fcdaff59176d7494c75eba4557a0dfab2205b0f255b457329c88d6ff7e4da09ec1be7de12ecc22c57271bef61b97c57dc64de93058a6cd4d0a8005e12adfce2e177248521d3755c094d0317e15dab24345693457a4d41cd773baf18339aa5d47f8aca882a6e60ea35bb915848ac19e7b7e1ac323387ec89ec4b010a88d695824f22ecf4f78a31554fc145adabe68bfb3b4478511179747cbe56bf46fe61c67f310", 0xe2}, {&(0x7f0000001100)="b26decafd46a3bda08d3ef3b2a6bf0c96db1e94dfe02bb0fa7b31ec25b4c74c7d5d3dc7cf18f40094dac87b5098dadce53252699246d6afe222b95adacf89c16ecc16209985279aa9d", 0x49}], 0x2, &(0x7f00000011c0)=[{0xa0, 0x112, 0x2200, "bb8c270cabd5dcc50bdbf4361a125222775642f6b00a7555ba74c43c6c2e287b2efa044f65ece5852ddf78679fc9e058be1f56cd9d9302608e7214ec4dc8c40f9172d47237bd0fdb530ee35b8807e7336ba94e7839a7e3625fae77bec6881f8b8c5f9ba1666ea01375eabaa3674e714c6a7b04f0c9ac3797a889168cfd77f223821a79184111a84f757e79ef8f"}], 0xa0}}, {{&(0x7f0000001280)=@nfc={0x27, 0x0, 0x0, 0x6}, 0x80, &(0x7f0000002680)=[{&(0x7f0000001300)="a62b374295ba97c96d374ad4fe32cbaad8d48af7fd7d7b57f226ed47982bb9674b817e609f36fb74f55fc66e6682d6e2c90302ef08c630783eae9dad45a10c1523934c7ed39ea535984ad478b3578dc4c7e3d0e104ad7a5bb0772be3ec876bc7d42345f7e191d6df39a9e348661d4200391a9f77f9eb3e6859580809549372c223722c4c493b8b6d096676fdf85e33bf0a87e3ff0ccc7a91fa43da5de33180e9067af26d2682fb3ff9f3d8a25098536b122e923afeffe026db3d4b523901fbd0d3433f1c81cd762b6b0bbea71660f5c7cc1d572b3d4def9a0a19c5af468d6663ca4f89febc6e0eba479840652b4200f643cc837094667c1391ff53925cbbccf396e34d2ac11d2d213c301b9dcbc73b60ed7d9ff23319f44226b430f77d80d9b1b87b30430c82073cf66da5070abc63372fe9452e7148c464cd1951f53eb5fa79f71e00174ae2859838f162e43257b8a45dee78b7734385c19d8b5b4515fd0afbb177b83b1ddfb54d4aeba297d4b6f41db0212248b2f0398afefc052fbc2df315dcb50c2fb80238ebf00e6196b723e798e9bc979ab6475db603b6126e9a0f4bf521131f3578b66a2df90f607a9f02ee6ba168eab94cb33e8766059fae7e16a32e5f4848a48d21763668d1ee55c88ebc6f9410af6e45fcfb7130bb70aa8c9c8ed43f33bd210c960c0ff1d8b759b1a71bd978b79c51c2cbff808fbacffe7407960ed99f548b57c7d125610a39fb76bf1b7b6a55a9d5494daa8dbddd96893dde3c261b91e5ed6380846f46177ddc2f142963c84579a836300422b60eafb7b05a32e1b11f79ca7fa40b95a0ed2dbaa4f9f61d3251ae9f2f926c726e6b88d27cbe285ecf95310e720b0cf3f9e8605a78e0a7e2d03c6eb5b89837a87337323bc28e1d3f9e2e81c27ead652ee9c56a6bb29210bd19dfa514f5e87b76998ebba737c4380a2b353b6a385c7cf601d72fc6c627d412d9f2f524e2f2111aa425f34d010bc9c28fe75fcc4b239377304a4e05ccc117dd49fec0418fcc8acf8e71db43e93b51e0e1c15cf8a9d06904d7a6b86909c05b985b2232c9ed86270653cb369a8b329021536a24c2d4bd0bf974685c2096c772a83d6bd9538a37edac62ad5d72fd7190efbeaa712ba2c07815997b84adea33a5084372bc233b531b8f890cc6c46a9678f4b25143351744eb4bbaf674daf9b05075ae348f0d31fcb89d95f480897670ec8d007f7b70bc5db4a8a289095399b81f15dc6f876427664d33a72adfdddb5291605e017f7b37c0d42d16183f3df725c54d29e45df20a421132483abaa820ac0c08db19f6f0f77a80b367fc73eefeef6896f9a3edaeadbe1d1a825d1d44c3d0228689912d120498405c0647bcc803f5287ae3b22f11bd84ad9173357a0a33bfd6f392552e7843c8b77bdeef079266d0d33a9c785b133f07876cbbea15527954b57dac7b58ab7f58b32016b345d59c799e328a3e247076124572ff1316db373af6d1f1850f6775016d567e50022500b9e124ff6d18b7279d32a8d00a2611497807e53c0093c9b947630c674065786b856ff1ab4ea3060116c57a068af5e9e28fbf291402c0e7d5022119a7ceeff64991eb57e2aa54c5bd66eb718538134632d5de3aa6c15cebe5abd5934a25070ff104b559a6d7a9b5ab3ce38a3cc5d0ef972906766ca2aedd9715d8b22075f55ea216ca3e5989b8258263ecef1fefceefad264e382b2ab25fb9bab11702e2b895256bb2f2c2f847e6ab3b41b49338827e562135c7a86574aebf23b39756dda02c9d447cefd338692461bf3e50099a973e569fdaff70d7e3946fbcfe8944eab0dc794d668e6fa1a03a9e91735846090147e0663b2d1aea0b6f94098a75bc4d19e29c4e1740d0b2c79f3300d1fcc85993eb605199c2e65c65c18790a20a4f89732fd1a51063086fc9814fe04db6d89edaf1aafca6c35bcf1178c40d1039e262ab8bb15438fc95ee564b1fc3af84c70441ed68d981a90154d5f686357c84ed0ae5fd79d8dd22ad63e4983f003a5f9f11ea71a66af967abe90dc1fa96879e81b1a0c9a0e89fb4abfcb0e0d94fb36da6a0ff6bce8ea4cabed4f97583370b8f79284367a7cc3c2ba7b28fd9c607ed5941e2bf93e7b7cc10f342747ea77f6957ccd2767aa31c6e5eab06587ff1d156fbd21186c1d9a94c5709c928619ee272a64c7c88952ebe35d4a25d8690538dd680e6612f74ac9cd4f01f9db4a4d3deee79a003d2043c09e01fe049fcc8f3429bfdab36574da17242aa95fe2b0b67eb7bafecd0ecf9bc348b363b4170a5c90efd5df565dbec838622bddf601a49da0301646a1d73776b482f31017f40878b097f0f4df83de2c6a8252982a456cb4c8d1a2ed4ca2a41a649fe80171a0bfd94b8de4d8e131c2f7581bd1a22412c9de0a20ca29f058a56f6155ba4b64eef0fd8bf108e29769b82596011b3b76be385e2fb695a3b969749fdbae68675139ab7dc6ea891c78c6f753d8507e3ed039e75849c9a387f48f2b1989d1072e89df81fba8a0aa61d9dc20da3aa93da0059e3ef95c9837671c76f28d8a3e8a6e1c2efabc48bd192961b6b36bc7cf660ff54bd3f4b04a4d9639ef754df5f8e96e966845fe0149281b22281292671d0898554f7bbeca6d9f2db4c62f4911e6215e2ff228ccaa53c8549830e42989733fc0d1ed6e061c7974148a641553aea15915e7f9bb9db4d5c476d6b6554dda776491b0cefd590157f3b5c66dbd931dde8f6dc494489cb1d89e28868b68b93400ce4dd7ddc938d36c32dd60242edd486e5c589ecc37c7e2d59e4407af634529dd8b774c7c6b31ce8f9f3f0d4024cd7925da7a20eb70249927f305f7c8300227e64e8db4a0a20ec58f3969cad89e94e1ba7b546d29cdd75bffb3a4969ba981b9105bc5cf65ef2b642288c57be6762f5435f3fd7b039bc3f48362a1671333eb77c6ea67adb3773e2cf1b4bbbda821202f8a79d138e2e8446385ee5bb2332df0bab7082d85de52bdf4a6c5f54289c254594d07b8fddd3e98d42a2ab03610d3c9ddd766cdf0b61c16f3d4c8801d2183d01cd6bd65994af296d38487ea3771aedf10edb342f13246e98c9c6fc4a4070a15dbdc6579317d5e2172b132a72b3b47d4c73877ef40755ab7547cd75b3746272bf1f7747264d22a5a18b94b992b1eec674f644c425a3369d807f92c302b3f1627d82cfda36b54f51bd9bf747ec2eb7c8f4fdbcdf4cf8da038f63c154fa89be2a4921ff7b03e7479ed9cba581a9b8ddff6b0b35caf6736f7c7f82619a3fd3bfb0ad7636bb0a4b0537b2c7d05103f341c0c207f617abba361cb8a9a372c1aeba31f89d03e3b9159214e18b60e2d72a4fc0980adb95a1b104b320e170dd2eadd5ca7c1c1d581fd07da0b6eaf08afd163640d0d96fd0d472cd68b210b81373728ae5df8683582ecfb6254d41cfe2a46d08d4b9f82e6a2a17d3fa2e1211ab1d9bccf94d7fa4c59bb37205832b4b791fcc6996132d464bab8ad3c189f11def76d5a8459baf896a7e17941f51b1cc17f8c1b7fb09f21b8566fc2e846d39cddd5fd30629b18988a344c05d12eadcc7002f6708ce09f4cceae6268adf673cd653adc708e8a6ddf398299081a521194649bcb114516b5505dcf9df7ad5d59cf87c84eba6b18650d1beb7b9efeeaad867a1153608124e862dab83d1ff211facbbc126063f195320ae982562bd7faf37da02ee44aeddaf5c86de2ec3357f6cd521fd9060149ddb3fbf21673d8f79721c1bba46e845f05b82d8794e7ec334e3df76484864792c83301846800e2f0db1e83bcf85a7b041624e2dfe33664298f4688c8abc27800bcd619541f9599b1a338cf8cccf4f7ad8a4bd027d2380df514ff08b9fa1bbf1af2be3a8d5297f7460042b9c215183114623121c6875dfd8035c9d3aceea11feb8c975c8751916259bbdb5b8715479c1f7378cbeb7b6692ff5dcb1d811409f09658ccf4b5f02bb09a20b7a6648076244555c2e5be8a07e3bf6edef8ef9be1e23d470e29d2b2a1c851c6169568b2d73b21ba8ca15f762ed576f6d3c9c6a55069886941d606460d223bcbc16f3a7efddce34160ffffb90ff664de3718cd58cad6ff7feaed889c675620f4a1257cab56d6080a9110ab694d7ba0ffcd4b75b8e0699f367923ee3c554b575fcb4317a3b8a243c337a47c401b72be7b6545afc7d3fd8a9df6531e713c67b2323554b63b50ce71815a8f737f3fd0cbcfba369267aa419f7f4c216224ea021953c407a88b6d8fcc2889ab47d48f6e82671bc3f1094db69f1cca66a4b372b0426442b80de3bf3e5b8b0f7dff38cec1053aecf61d50c21730f77dc51596a296eb320272af8deaa361d92d21bf7ead57d92932969dd1eafa7e004e598daff349e8ca8ba0687bb751a2dc68b67032858a1f2562e47b55f349c63a4306d59b8bf00414c343ccbd25dd5a17b6008478bebb28af9936aa16ef8c6751209a7298b12a588662aba4886a1feda4d038bd169404b37ac438edbb65c1fe6d07bcfc17084c564e86476cc929718e879953dc1b5c575d522b77557807ba3775ce2136d26be36db1f905749412b1d8706654460aa4945e8f94452dbc4caaac358d5ca5e7582777fd8175eb00fbf957579cd3c65a011d50474b289c3ec300480f2a1e1358c78049a0fad8bc4b7441ccb3ff9a59db279c4f98ed0b63d05bcfeb21a4639d94c280743e0a69c302487f917cd795a74da497bbea3abc7ccb3cf5961003aa845775e3681be304aba612ff5caf2204d0eb9d837fa2ae288f198ba2ee3a28f0080194df45ea70e9f9b2f212bd4ef63e823c2e7b5dcf225467c6bdbc36171c7bf0a03948ebd055fdc7103b34d22a36ef247a8c7099377f5237967a9756fbcea2fb6eeee5caca102cfbc4e6877c7b0e57232afc7f432a184ceccd22a1dad05dafa9e94d98132eb155e65354eb0b9875cdea46c8d0b194cab65e3f6b0231b36deef0ad60d588ffa500f0849244a54d4628b5f352f9274538f72edb6a8b2fd07b7b101ba5687d1b8a52cc54e116c38fb3a66e2ecb760baee6aa9090490eefc3171e0b9632d9de84fda346b4aecd4145b117d2cd659e403e74acc16d53e7feedae49ba815fbdfb7ff1e347da4b092e2fcb4b7f13c6084a83efe41de96ca20c1715c6c843abefe7c26abc0c4e47e73deda82828d6d2aa1a32d09e3acbda230a3b141bc524d319bd6031d1d2426a1f955338dbeaae0802721e76f3dfa20aa9351073c48f17c4654b14d7e7cdfef81d73cfb24ee570f8fe1b3dbe8b72ef0eacb1bf81e3f2af2af084067dd50a029a7cc990e0e21858a46647ac556b6cd5dfbc4c2c32e8569b61215724407f4ec84f58b701fc1b0584b214504d3892bc564690b1acfa324fce3fa947ad8ca5b0484cf902c93457967c62f2caa882dfdad40f188c81b0ea78ca12293804b46b4eb342118f46176d18b03a915962da1b6f835f4af2de92570f3af4ed8bd1b46fadbd66ab3f9bc16493cbaebff546989e220ada8318484dde9446940fa9355cac2f923b39660bb16fa1efefeb88d4ddce8c580e3308e25145bcfb6756e8249c9390834b7bafe1d0bb6979cc8f03e81cbe9d1f48002fa90dcd336081702e652312a9e2a16758572544a02cab3407f93d56f149a1d6479cbfca408a503ed89c17b84e64f1cbebb7ee0420112a78cfb65ad5abb7cec083e60ce18241a180469daa2c7b980aa1e6730b6762d31c0a58c6768805c96fa64485b4e789e47a8cee706a245792edb30bb0041d6d3c3d72c35ffa6962e2fa27c96068de30e40486217bfe79332fcf0ab1024f9b214", 0x1000}, {&(0x7f0000002300)="e02bb129aa9c583d4ed35181a7985b3910e63caaff1d7f48838f7585a52342c22c4d8e33b0848867bab16e17039342bcb8fa964e30311ae12cbeeac0", 0x3c}, {&(0x7f0000002340)="fbe8fefed3c78911afc8d29bd05e4b9be60767814732b254f78ca0a34031299b7856cc16e00e46b3a594e2b9b4cc927b7fef5db5488e818662ffae48cd0f968cbf41e49310c0694bd7e6e2dfd984c1c930662a549a54930dfc3ffb4e89123347a61b92a528428880bf6ffd3b338f33ad7d8f1882d1815c75423ccc1f78f9a5413aebd9189de86414fc25a378a7f2738572f30be4476fdd6d365f6c4aa6872d285baad0bed03663faf729da3f6cc883cc1893134f47c0d5fc3b8aa427136e54a4c3286e75b4f02ec0b36f", 0xca}, {&(0x7f0000002440)="69272f1f81e7209daea028c85c1083aaccc9de600c9911020e69289a1827b471689fb8bc9af6a893b78015b5fa002ad5de33bfec45e6f7438f22bae2fc3b667761f98f4a462eb2ea08e8a105113ea427d307613213a91d7a7d276282e1b21096f080", 0x62}, {&(0x7f00000024c0)="9cc6f1b679f9ac62ab2cf66fb792d0e9793fd6f637b30be7dd988c37509020140ba78c337300ab93fdddfdd78379577d42121a1a37c39c2153561e4087a1c9f0e5cbad5cf9437edd7bb4d2cf5723ecff5a0253c5015f6fd2189f558010a7278c1d03b6c7fed99a6f7aed7b72a6b40406c87af8e18d42e6025b11534c8b1bb21d2555a5205222b676091c417f700fc77d416d0b", 0x93}, {&(0x7f0000002580)="3b9b58bd4c2d86590e9eca362f359b4c27e325b5d7942accbb87e9687c33a9047024ab8822f17498c567afdf8b30ea99e49b59fe883540ccedbc418cd6c259fcabbb88e338162695d7ac2c792a3f80ceca07f5ee7a910e366f76f7585d866026efd862bf4bc02f40711850531d97fc70e6125737b5ba32422ea521cf77763ee0b45dd0c22f89b2734aca80c770071118e0cad19d6f88014b791e13de6e154523c87e2ecd3b49736980bfff8a45cc6f2e503cc5948847dbfff79506c5daf30f9fd760962f80654bd6134ab5a390d54c645f1e1ae6afeb0dd0e80b1f2dc420", 0xde}], 0x6, &(0x7f0000002700)=[{0x70, 0x108, 0x9, "63ce8bef8a82e251e5238693313644c24e972ea11292b3b13cab752ded9fe00012ee6839ef1a07bad1b6f16fc044e8b6671e934a9872cb5bcda84b199cbfc76b30d85aa0e064dc6f520f501ad04295268015ef2be1c3bedbc6c6"}, {0x98, 0x10f, 0x7ff, "50e39c518dbbeabd4621e16a5800333d09b25858a1c02eb757969507fdae2982005c0c8c159e904d0a2a526286c097880dc6c9a05472efdd254eb487f78bf4dbb488a6a163499fb931c2c35793c1f4141b3049ff68174b91a8d1fde757b64b34072255a142aaa57d2add79076c2ef110024c5c85084a3393945bf87b53edbb02838c8c9e37f71b"}], 0x108}}, {{&(0x7f0000002840)=@hci={0x1f, 0x3, 0x3}, 0x80, &(0x7f0000002b00)=[{&(0x7f00000028c0)="69bd594c2bf5b592545d41747d064f8bacd5386f25aa285c221b106faa917120ef0d67840c029919edfae354d8efc7a9c133a71051c798974c62ec6d2f1d6ce407ecb9d6404fff1ea388416412659c87e2c0eec29e9a6bcded68ebcba06811e158ccdb1d45361bc8d6a16e164cf98afa30e00d2fcad8e7ca88887c511705a5271663bf89ec826e7cb5a0bf12c9b0011f4d2d887ffe00ad64f8fceab6834c20a532e10b4ee1f437b06498c1bcc7f9214be5aaec03d7000000000000000000", 0xbe}, {&(0x7f0000002980)="090aabdb0d9e87c189002e84477da62496c76e16d1831bbecd7dfa1104dc140367390216b84b79d9b564d36eba34a119d345bc1651ab42e64054fa92abdf69211dd9262f1f4af54df7d321c1a75be93d988b95959e5f365154e78641ec35a0c8716ac1b701aa20f228e0eb63b9314981853de8e957d9ac63a39e742a245426c8dc1956fb5f9781a36c90b08d42f42c6156402b127b261a4dfdeb10f001ef1f6933a6114931cca211afb682f9427aa4950a0986927224bba9d7b35c7e85e9a401ebb1c42039982cb23ef09ae4619e17f2723167d5051f2e4320d0976d6a9066fcbc7f98cf19d0f0fa1e7c00a5ae2ee4640ea8d25aff3a8060b7a7ff", 0xfb}, {&(0x7f0000002a80)="7b889300ea4f77b1b7676dc71445040b9f95ad61624c9b3c55df581f082b337000a680a35383b462d126e81fe081d29b6422ca30d95789a7299e2769ebcafaae1056a279e72060f06573a804ab8d549ff3855167d88f476bdc9d1ef5ba7978f28ff15fee2cd83f43dc602eceeff36fde45a215cdf0ca", 0x76}], 0x3, &(0x7f0000002b40)=[{0x1010, 0xd4f1184dfeb2d783, 0xffffffff, "dc20e1739938ed2e393bb37ba0627f833855778d7b755618f1e9ae015de9baa36b21c80e7b778e726917408d9bf4a2a3ccbc718eeebe221f60146a6369b1fd8e15892b8c12b68c2b8b4c462fabd8a9fb028bb9d0e58e9eab1fb85145a604ab4971b7d524c2b78584e3fd09f17326ea7f1e333be6be58e5e91d68b79086b03f2bed0976c81022cfcdf3f95b31a75b95c3cac236423a3fe3bede1aea2b210254374de4bb18f1f59e6be8b82d52be2d2f00a15431185ace109ea32da277ce462e182eba78e95348504ce1ccbe325e74ee6336ae19813b4a1e950883eee09bfd8ffc42e62dce2c659e4c7901f61f1626b8cd04fe5c5a01a9de29e0f3cf84e2addc17e4a8167a0ef318218f1673f38f0612ca282dcb2459d98de8c1e51b1d9dbd3ca6b2579f6cda734878d99844983ef67450380a80fe60cf5f15b3564ce0550d5f635bcd679180179e0d831a45b4e4efeee5786c63d8f0b5550056b0a06df787f2fff761233b73511e4f3962ac7ea6fc44d75cecddef71bfa39675e5ed295ba7cdfcc84fffddf86d0f68e360e35b2590b9c6be602d3271e8d52b4c79e2ff33930d5ae4035b62f478307ea33fb8021e9433bc0d5303e95c12c636d85249934e7badc8cfbb242113794a1144525b86dbdcee01732df4f94a0af04f1d18433abaf275d8b2ae60d0e8a81233da0c8e8d75495ef249de2283ad8585a678ad72f6c697c90c51b9602d81eac9beabb28f34a7acddb56e6d503f19365d04eb8ac48349317ff9eb881d319802dd387516850fa3ee251536f9c27c09f96802f1528bd48a9de4a128784e5c5e8f9d4f08233491836adb4f2e5d02a646ce38fa4cd4907880f201ca055ae0fc11dee38e3c092b41d0770b2a546eef9fb0c96a1038e8630a67619fb0f824fb5867ff320cadb572891efe4b99b939deee9b1a8d707c4ec34c0c231fcf4feaed40e8fe13617893a98dd8dc8e0fe69ed440f192244f37f5855e07cadda473e277c6a1e197a934e244bcba39facbfb0aa1e37af8626879fbe2e2371b08dc0aeaf5051b19d8e3487949ea9650b63f9ae9f09b10cc67f04ec537b090ca81acd604f614794cf06d5fa5ff3024f5976b6082d2bbfb92896ceb4e2a5e7ad6c50c70e757a3886a833fd1aabc22f83894b5a80509587bb797e5bb64f6200c32eb67fb63c8efe2a745e204e871a1fa426be99f84d34f063cb97d43d8a8163e5f82bff744d8109a5fefc710c0c71f7e93bd29f8d17f3ad69ec6a5735827c8ff0c1ebd81f4dbc912f94143a97d81a101dcb2d8bb78235c27c714e663f995c8967d62a66621cb5e063a28108bc102a73cfb08983bb3c2def53efe69111900a015cadb867109d9479210e25eb2e4732c5b4ba1399151d1e88644780c8f220b9f648835c21bfbe89a508a6046c85c560873f1e1c63c381c67edf045255d2b797c7ea3aa9a43f54ce414404a0a3006c85544c3878effdaee53263f83c8bfa8394eabd2be672685a4e53446a3cdbe47d5053b69d7383a64e0a1ad78b9a15714e577156d10476309d6f2018dea71f149f26c6a6b2434461ee77574674ebd8f76df3739c34ebca200b2543acffb6530d20c4fc31c14f12d4784f247f763db51d5441151fe8ca8b21502173cb4d63cbbf967cab7242154b64470e5c27bfb339634510b3fe57dda5009d582ebc5161d09988b183272cd900468c7122d3e3575e51b39839a3dc60ef21cb0d3bcd9cc3b733d5ad01821f430f461a88911fc201a4616eedb8efbfc995e8daa39e8b85125c101ab299eaf21effbf9ea84b5defadc948ba9632b92c030b02a7805650152bdb806b951590cb3903917363d7738908100b565cf1f2168fb7177a19034bde9b7aa0365f487a59eb972c8681edd97ae1dc9a1290d204345e123306afbbb865c021aa1ff7bc8cbacab3054a4e6be687e383729f98337ec18fb393d3360c264d4ad638ea7042dd02eaf3f74bbade6c33ce6b35a308726882984d885eb0d5ccb3635860ef83c49e5b434aebc6e7ecfd39a92a1b11974fda38c1db87f34528d085d001b07d64b4daacf1d5e2359dbbfa54359f5b2afc977b531c5d5dd7961711d054635ac3bb8165767bedf71568671837e40939a0659dd36de7524cf2bbb835340ca97c7b7f0b740d4b71281e9d200fd9eb51e56c942a600568710c758f0bedeee859d9733e55f342afce473086d43646b64d6b9a7ce1b3492259a125fc94d5997426573e1c11bc15bf94d436027d4acc978d9b5a3c97cbd68b9b55a62b9a93edd76791fa99dfe010a8219409857ec00abba2d931d7d1e7266f0a17c38b8260973ae3fff7f3e47be7b17d628905aa0452d94559cdd53d6eb375434e359f0f38991fb2d89606bf1fdc164e9b8279986166c8e4a6b860da9592d183e84ae6f0cba458cdc941e84e022d8d23ca0f4a8b9dbc6ec77fb3e0f0e9c67711e107893abba0a732c020272e68ca65f0c59cfc059d5f8571b79bd8cb7a30019d4e289933b48c03939fb65be7dfe8b95ba95b5ee367e87d6fee8d3f7d5351a24c1e703d597161aa84da96ffcb474905befd8d9852ef453d3a1d71bcd2325421d189446c44610a0dea1318abfef0f658786439c71c66e73de58544f6fbc175aba87f77c48df26d28b7a85df41799dad64b39fde1797a31a72022383d530be32bbac9245fd593ebe64c1e6e5778ad1039f08d8baaff1b78a7364a5ce9f5fafbaec8f77b8c5188afdd798bb9065f975a5a91c9c023787a2a65a9c579680af36dee49453b3e21fe218872f49e64ed956055d6ce26a6dd78af27db5d5175570f81d110f6f00b70d8e88297b1eff6be03d4ba6e5dabe5e57e8a0becd5c8928fa10117ee5f8672b8b900a7f6613b606726bd7aed642605867d5db62eb53706261091c4314eee742f6947fa2ded53420a2a55379481ac3c27ada700f5bfc73e7b2e639663869394aa2343a8980dd9031258ae4218e6f1ab848c5503379a88a67f6ce858957b1fe1fc506380ba6104406af90cf6d3b70c97c467edbf1e244c78542cf24bd2b0b909df58529b80a3609e2095bbb162eb5ff8962c4a2951d68b500ab1df69db267a1070989faf0e74567e960bba9072ff09e8d72e203d78d3c840c23612e5a047e55ab756419207a46f49482b9b9f8242daba0e3cb9d461b4dc705c13f46a7daa49b91764a39327c35135e14eb10f43a9fcaa1fd3a22dec55972d657189280893fcab2e8e8e3ce472dc87a25bc74fa370c91ed41f81e54eaec215f609f83153285b16c12ad62b7f60ad7508439dc58e40997a11dbd81f69d1ce543bd0916718ac0ad6f7d854e9c115d6e5a73584646c0072993209b8c56033d6a47d425a4b8031803560108fe8a2fde66086681643f1e0c9f359e4cdd37f479081a3ccab590553f4660936027299b51417bfad32a14950491be914959cb9025032c084b78d4aa757a469902a244c6a728a50f10a57ce14ed967767c67534536b52301bb7530feab387eb4446d7d5c6c7dfeaad0c5e2fae396ed4f90d71b44fd1b2453b574668a6a2b04dea2305e2d00c452d6c4df4e7f94548c4801be9dd84bd5730eced79f6bf264e22bfa12ba9956be6b4bfcc2ae1c8c7751548f427f25ddae77b104a0094eeaeeb1d05a7f4e9ed13bfab666fdf0f89df388f7052a188d0e5f4848a24bebc8e4c0a52fa6e6fd159d88c68009b0fc4b481f04571d431bf99b85696a84d72b3e2733b5232b1af269b944dcb2acd47bfa64716a2cdd6beadd9f41c71282c5782d064f96ca1deebb0c289aaabf8f43feab1902c03b046f82250f38f3623339637dcf4f34f3ccd2d9a8205628b7ec6d0743c52ec20bea361cec510f1e73949afc2ee06e9e6eae880d63893c65b4d129b1a0c7287efd90354fc223f2c0cdce8ef0ed8a808c737949e1514edf257f0ecca31b8af38dc981374ec7e300706fcd6291b6209c5d1543f2a5e23f34352fb7d6078f0a7fd6c42ed19ff61e63e2cc7957c62d7237edb66db0bcc61a7131306bfdc536fa8bd27d6da19a9b66d6fc3afd0dd895932e69d33038a64da16d74335996858b9385bee05184ac568873dfde1289393b15fb08ec3bec8a49c116ab25de7f0e37d01475ad428005df8b19a57c36c20700abd183178e9462f5b5f0c500eedba982c5a76c534b148cd8f26b58b4d600cebf5888804689a081df9469ac4ba879f96aa76370d07f22d61713672b4e5ca5701f461c30cb0a7466fb525a75a0d8d4b909ce160cea4be57c876ca4782f6a627ef1e628bcdf25b9d1a1039fec93f8e324f57f4912d5cc44da06557ae870f7e2771995d18d906cc5fef5ef881081154a43df8f8813da7d9637db986336f1a5e7d4b3c889341b32ac2e0c741c0db2925b51aac45f867d8d89f5bae13ec5e7a5d1873061ff6974adccce9b60b8acc1194b8c6ce920776b91cd11f122157b430bf80277ef75b0b8f20c1e0215f3bedca0c1a6c5b3664f982fbb1267f838c7afc6e7cef92681e4cf2d911ed61b86d00b7927baa4f334c88942a6217055fd38674cdaa48e436ad6133a482a2a60b8ec6164d24c16de5de09e89a5991d65fed33123d3b7209e5d879beb728c905cef1ad823d79fd590b1480d36f552053c1a6cf8655002bf5864e02ad907f2a42116630873680d97f4a763c04fa7dfe0daf6011fcc5b61f445b43cdea8a6edfa5d7e32d5ddff263d4758dd78c788b150050efca51b1278244d2ef6c1628af9c117fe18071a57889cdc4787c451816e51fe34eadb418349db2a50d2ffc76fdb439a07bed3b449ec1223efc8ebacfb93b29cd0287a24aa02ad094736ba5d37b050265844331912880cf7c63adf8a92033c65f7c0383367ef19fda01cbd49ec812cd92a6932ac8b1ec984f8fe5270c82c84ad17c0cd1851bc4ed35d08f9c2e8f4c3dec93191fed1653713014a2898e69fb29d4096feeb9e0e6112e7491b8a13ef5a331023b2b1310a8735130ac91bf05217a9016c519a2ad84ba614c9d6a198ea07f5011b5bd40fd2c766c5b72c3f66dfe41079cb3a084127652074eded61d08774498642aa99c5c60857b684bc017ebe006289cc8f7a4e1f6d597823e7ec2d8304aa7aaed479d41c463a5a1941a7df126565902e836998496fc49826ac7d222271f1ebc7e3bf6579c9243d269f44a17530be8277b6b62c6282e4b17f34b0aaf1833bac513dc4688992351c22b350951249b45d4aea1beec651962be16c8bb89e775972aa52948411b378841daa463ea6636b9e110f0434bb7fc9ee6dac1e3f638c3d59d9d919a5bea66f4bc99ac7d3da16d85a0c3c8a004955adc4ba3d34b6e9b4a65c1c37c09264c1c8618079d79c7be893fac0e99a7f2a310919e2385b3ac76d9d790ce57855cfcc806e9e0b7cc3093f052e696736789d16323cd9f17569903f9cfcdb2f0c545806c200127793faeded721db7657d50e66465de51702f8d0e1af07c61f0671a23b01fa1855adc3f32bf1e177313257b9475ab1a84f2499a83337cc999a1eb76303d17285876545d02fd68f30b943e2059be7d611cce45329bd3aef05755b5dd69aadbc12946bd62fbf69137516d503d8cd7c02bde853e4a562a47cd646441a38ba2991df032eefa0a9dac434eebd5de603c044b84e5192181416a2972c658f147df6e91d919a7b1f2ff5d65d4fd831b53c8eda50527d17724016f1c8d264f130d401be7a444cf37f34fab66944f9fafab6161e51fc96558c85412fc2d6c75b849ae29086b530087be74855d47253734a4a229896860f47186e70837c067389bb0b1177c6571d8141c2e8033fac6cd1ab6"}, {0x110, 0x0, 0x4, "95d0689688d81b7770a86d6182a5b81b5ccdfc1a3f65cac4e87827f3c74728c139724723f843fa3b6247c359287f94ad4803a1e313dc50b20516b947dbd14c83aa9da45a0529b074021e1d4d0432fe5c7b80d2a4d44bc322ffa916744066a5713f0ccb426c83c631da6d866450b0bbbb7550cefd8a134f3ac0c96e54116bfc8974260e504ea7857a2aeac9868f5240c3e2e029f2bb732b91eec689c499342dacaea398650dae88e5105956bce4c1d85fb906a8151664a36cfc5430fd6eaf4cc156b828d4b16224e67f8f66070cbb34f3240b31a13137129d97b489936414fbce5e3760cbf6da13edf2232f34cf875e4115734b6881f05d76d1b99928c1"}, {0x1010, 0x104, 0x118, "f339066be81cbe7f6ae8c1b9e2355aa903a728ef433228424551e90be63863f4f4ebfd064d572ba1a9c0c00e75371454bc2dea681b9088770ff63c1a9f51c57ca9b435c9436a3b0f1bf440698f8fc6724dab5b1e237abd6be7ecc7846a64a8598656a70085bce4533247d6e12ee1b6ccb721e8842d8454173c452ec82a7893361dcb570ed3f09409652fa90d25e697f830fb226201311b3796065b664eedba3584ecc08fc564fe1cf3d5f1e56fb4c49597a1120e08a6c41e484ca0b8fdc05c2e422a080c5c9010418e0634ed676f6a64a987894d265e66ea6422e811a6a476b15c3b85647161a25cba7c1ebec8b8f319f5a658d0f77bcf3cc35e75c20c451a1689d11b1075281eeb096a04933d63eb37ec4c025b7ee5492af5223170e3eaa0ada98b669d75a1794e7a7af68b356fa1c4e86571e50f841893d944707125f29c862dd14918e84e8b4f452aada608ab6d62072c0a56c7d93aa4a5a3cd5ce1003734d3cf51143a8048ba862651914953dccf4d4d9dcfc1bf2f2b762a8bd01c91287a26dfa07c317587f6fa4f227f7b2f8e4d7df99ca4917e8e38636a585a822705b545342e21be7cb1eddb6b521e884d96d1a9c45265000471c95e5f59b81749224afae851cdc97df6921cd35ff0f3bd8acb8353960495d1b71f91ddaeb968915a33eb38daca11083e8fdd1f9614a2946bff76f66fb21120043bc1c82aa7a4d81149d6d9673130b1827751d9c3192e08994a13f78168d2cbe147c0bacd2879bcf3513ff808364ea2f17bcb265a440d7a9f2a410e9f626cd3d8da19705409792893d0f8b7edd02725f863fb5b35cee7f7ac36aeee9a0ba385b946a777062b737731619c0d98f2728559a48c675db0913ba93bdcfcbf944762c28e0b6f3238caad47d1ba4b54ea27ec60d8eb3638000730e6e5a71048bb0cb9ed97ec366ac1d040ab3801b2c3e00ecd8da92da3d4e8ea499a5260a153519b7ce898d9a3f0bc8331a71c2750c5d822e557a31134408799cd16d96be36c7e521d9432d84a9b8a6886f4a896db616af42ada1c4e3bebd4a0ff898b2e0e9bdbfb2c3fd4963985e5015dc9efeb368535170f3cf710b3ad9a5c686ea9eae8e870d7f4d0cac4f192c1da8b37db751b04ddf8e30c704ef4a83498e4219cd9c9462e94b48d559eb43700e8832bfc66c67311c40f309356382f1cc16c4288775188e54cf661bbc2711d4113010d3507c9ff0f33c271c3b0ac0b448f5eaf1dad9f6816d8bcb04ec7bed7409a32e953c642993435c0b03c0801fb67a76b712f372c30636e3f80391d5ca85ef2a4b613b6f029310a980833c29add736d3ea3b2650b088ab94971334dfbffb6e8217d6e22b1b68dd1e4366ebf2b35390f6000f569c51f87975110cecd9c045c19c2483cb90b5f9ef4da138f82fac917baf6d371a2337ff3e882633d87a7966efca5b4cfc05d2f5a57ac191b3fe8570e33972e72b33e9b863a88d99a566a6bc4e37eb368923cb6b1eecd86ec9e24e1857f6456ba2e0b1f9aaeb0029e4dfcae11c5f3170dd5b3935736d3446b7535c8da945383a2f2d5798432c84af15b81e0d3f5d3b61862de83b896cf6eb395858a4c4aad4c202d8832d1db1409317e7dd4850182b0ee16b5d6b7b9c9377b752102e4ba3a5d2a6166a506080e9bcaac5c0b74903b3c6ae725fd578967a27b95532a8f559fda650251fcccb6c4deb0abc8c550ea9f9f3fc0fdfe7b0f12edfe9aaaab91f2915c596ae246fdf0947242ddf163ffe75731bb40beb04773f72afc04069d0c8dffa8ef4c01c76c57e27100c6ecbb9a57662fd52465138ec0752c90e15c8f80b796f8157114aecbd63f45f3be2fa5db3fdbb456c37917be6b922ceacf97f20592f9581f4bfebb08cf82005f3739ae4a0c730ded95907514c488cd50da39d14f114f7f461c708f8e8476a7daa4fb1ac9375e426fd8780b90936ec05ba4091b3c3c637da1014a4f5aac669932a5274765d78188c13c31662bb5e784572627b26c69221f8ab85de46b6c461fd630ad21eb67e637c3f1d577691538a1f203dc79cde1d2c3b3bb6f0a4a4eea2264edb2943e9162d4e12e01612f8e27888e5cb60c54af99bc4dde2813d737c061b5bc71ea46c3dbe4239c04167cbea1d07a44d9590b6b588669e871211f86f4314858ac6490b144135fe07633d2046015349aa35f29d8fb1994e12df0cdd731a8798ce11377a235041bc727a180af0dae041ef369b53b40d01d1ce300ae107c60fa87d4f40bc8db35112bab9dafe3e312825901506941dfe5af2015835d9727c655f771a7cdf4c61f3fa34ccae73b9e92e7c3fc094e6166d1f6ad74ff45196d0917c510ceffbbf0cc0fddb7fc3d283353375687adc6ca2e3cb7cd5bcc14dbb786d254d43878608030f43e4cb41a3eb0b1950bf887b63eea8829996a59a9325f2afd74e3b06fa198eb26913e28a119bd9eb8ea78fedeebde83016a61d33c449858060c303b0dd76088d303b4e0cca16f3cd6d6bf56a58120064689420a1f8a596c7dd64f4ee946a7c36d8ee5c9aa86286fc69b823cb92f8ba915b0dc42e997e310c0fc60f44ac8783ad991e0a8ffe0c52f432437720509ff8f6ffd0e249214224f8bf582f3500c6dfb11dccc2a74a63a78650024e1820b70ca8213f318f49154e3d86e159ca8cf70b5091534a343d3c3b8a7b186f15f63eddb90535217a1278091511668d7492915bc946fc4326bd84657d8aeb71661f8130f180e99c0cbc028928b7105d1b93ad71bd2474270909da808600c25234ac8dfc74c65cddb3891e68a559026c2be14805a61a2a4fbec18f2bacf068f1fecd31e39ec71e199d408b3ef43e031ddd66074a0bf33d08c8823c9ef7e2ebf9da530f6ea4130e71f4c13c0456c83f7aabd8cb8e3f71b01ac20582b4b6f59501c2fbc0a5a7edd992f1795a98d5c792fc1ce1c036dd817110cd1111f716d7709b5a4e385c61902a5b8dfc0427aecb50e7d36e0ed222c73148ae333e59c94654f8d5fa992d6e382fdecb068d783d01165b492c61fcfabf946c51d54a7897e7cce3e74a3e804973705027a747b3c4488c4fe93956808a3b8f5d2c7aed584af45801d1389fa33d9776f7342e73840dfaca3c3de3c2e253ac4ab48a3aed2aaec8dc26e139920873ce7cb9f07b864fd00d1b3f21810e71e6a982fb416d624cd4d519a742324e57708d5a1ea155a210980dfd48fdbdd9f2e17a36d1ec1085ceb46cb8df8a7059c2c6d1bffe56840aa9c44536737fd2560ea288de5025efcc55550640bade8a815e27d6274aade7f8229c0520abfbdc7a830ecbd053b48d4346178d4770eacac9f05d839ea4d516969257e9db3178c046c58c9cee271594ffc1850ab0bb4fe56e634ab6e7e33143ca06273e3b339d3076c0065c94ca872d9d79e1e534e1ee31e70347f883b305c00656885df701806eddec29678df05e240a4bf617cfbc9079324d705b1dd88e7e9fe617a3238d12980850c0fa5a1e4197d609d41038d25ce4e07b1392edca0daf792ab1902296b3d834e2a9d718b0e72ca710baf87c3135606ec7872bcb0d1db966875e4b629e39e38e17ae7cd080cc25cb2fab837f53587eeecb83db06338deea9ae75c4b9d46337f216e73af8b908310480aa86a77b1ffdcecad4ff5681e9444871be67626c9c269037684215e61c2d13a522f4f72f792dc0194a1cd56da43fbc47741aab24e6e214c5e39a8c673711b59e8533e3b584882eead89b1ee2e851a94689c4756c940b73ade50ac1a9e8c40880fbcc300e3f6dd62ebdefef9643e1b6734174e141c3ae78b484c91950d417b72d2df8f9414fc8bb3f8c53b30bfc524ba907470f931aaf5b5504b193cc0bccc8692c6cabf987bbc57698f0d91524cf10031afa6b820eced1eb2aa7ff3faf582811027e7419e0e2688e661a2730583ee07b594748557a8be0e8f31688f787fb01b18ba65d33c6d986bbaf157404bf4fb9c91a65bfad472b614277ce9f906e6b19587741fb9b0df53065d563e4f9349e70e49dc5c5d8fc1e7fb57467faa7ef5b811d56d80eb4aeea8e10b4c260c74bbe4dbbb3104de4dd4320b18380fec18e3a0e60a43cea259530b4db979388e2eb31bb79e3cba75397ea96d173b6eb34c2b4a70e5cca7f53f725699b841c557f91e0f694861c683beab9e0e4fa8e33a4139727cdf098f5dc1c9daec638237dee676aba1f17093a7211968e47dc6a7ad890ec13d0b3b8024f888912961bfc94d50fd5c2ff976790393a0e8bcbc32dbb5042b24901e84fdc59b3e5c229e3be6b050fa5aea06f097ff478bede91e5e40a8564627ae68318f3e8deacd9614410ef176627e12964af336fdbdf2a57b60933b5ac85599dd953480c92279674d555989d4fe795cae899e8af7332e7da3cfe14dc25dbaf3bed0a070b395ad606e13f75185155d2df68b96648982cf22c8d85533ced06dde94f2273a663bc1eb48c99c47ca027e874356e015d6d8747ac16904c9113ffc266008b36c75166b56bc0da38c4791b265565cf371b7a975cd1ed99f261acb58619998d3be169bac33b01dfebe7d3dfdeabe8abbdecbe21538260c49aa5001cf94f52facecefa308166d2eb5d632a3a329da53924965b0c3707a0eda67da91866bebbd775df97003d39abb2b3ff31f9358a76d991a0083caa56e2fd0f3f2cc6d2dca9684acfcd33fe5ae5a8e006d7b01b723d82bc0e882a01ee12e7dcfad42e810d860098bb1b9145b3488f2e5874bc98648844d546db7412b12cd49537f567f8a8396ca3c991ebb15de4642e7d0b1656f873256f71872a43d91d7a270d1363175e75b5fd3d122ee8a141f18a028ca6dff85efedfbac1c50e96831c2a32e7b9805fc631090f429dfd2d000b89712f94d4602bc65432d5d12c29d3cb7228200a387d2d6473d5f5f8a811a45e514e2ffa613929d77209249a6c56bbf0916a21e24082d8c2d1531d730cfb15e9a775e6bb96ed0afa4e56a98101f52dce102017c1388f68248d1bcbb4a7bb13f66d486e9fbcecdb2403608987f527c7ef56d79659c736237ca5be3da702e28a60eb7699d6d5e9d5d3da5c665b8bcac5607170f2fb90cf3a3fd24487aac02ddab7ccecd0971e18752649c2c9a76d08e103ef611abdbe70a4649e992c9dadf67f87d994ed940867a1b9612c78608da731fee982df75fcea11670e4e2e608b87ea0c818d24f49c7bfda915c90c4c76aeba75a73697d634a94b970b71e25849d3ec1bb96a1a7d7468f9aed08c423a683a1b14d7bf5ccec0c17a22d18d9dbbd81d5948d3d38df2d9913683bd0c02f8153596f78b4e450dd3b06bad8de5c5334ef8e0807d41920a5685e0da203eea651f138b628acb65b911976831b1afcd5efcd2df5692993b4e16ae4eaf4007a328968545166819fdf4a9467a17056d1b4cb306f7a3d73aa76505bfd1e15953df912963a71505eb93931628d49492d49ce7b26ea612d39bbb359935f85ed63d40bea2610b713565f53755d9effaf5d0d2f6d118cb9503116a5048355a461496c5c6f490e37eb6f66bb070a1dffc792e6066cb73502205c142eaf83a7ccd759668204eae7fc70765bbb602127c9664316a41ffcf2de8de2be3203accfe10ddd6e5f51966b88153aec21315bdc59d68726803885cae4991e2c5b3c743e6d9a468b7d184f5878045e74695515f5723b0cf2afba96727210a17f5150622af4b685fbac3c9c2051ab3650b125a2cb6f9e962cce7822f1f14e3ba604a194d6dbc749770e988d09e518eb29373cb4412c28545f04b3a3ae3a65498046f3dd32dec1039f777a37ef79"}, {0x80, 0x103, 0x7fff, "c9c3f4d5e8aeca72a70212322fb4c659eecd02cc642fb6cf3b4f16a856a91e1e869b65778b993f5a214210df35b7f68d81e9908126c997b31866bb1fff4523dc8a97ef1dee550dd319a4685ba58df79ec2180d3c192f8ccd3ba226a4f11fd41384e19563ca3d7fcd9ce7748b66"}, {0xa0, 0x114, 0x6, "9a1a0ef318cba0a7483eb88fe82264142da8ac76736c9e0e2f5aaba4b97dc6168c29dd8baf527c2c943697ef2191d7aebd3015ef87cfcbd0b919a63dcde5791ee39ce41c9bacd4aa7f4a7b5edce74ddd27f8b43db97762bad2521ad33e6d44079310b83704f4a024348f6e22972250cb57d04f1d7cfce883e1570c1226ef49995d81f9970abd1e57d466083ff7"}, {0x70, 0x114, 0xc43, "017a1d829f095b8c1e862e4c2b8ab6271bc36cf5f8e39839203a0aa9d0dca887dbeccbf82b7889ee89e38036066cc2bdf164cdf5d140e70e1584d0b53d3e3572c5083f7ba88f3f36a7eeb288ee5c73c5ad7a3b76d5e2e5619b281407c52a"}, {0xf8, 0x1, 0x800, "24e973c24b9d01675c62eb44911e6fb3556237fd16914df07b5888201b38c6ab3d0552a57ae68fadc41591f5c50fd1aa6209b9fe307e1d935f97ed920edf58de56cae570f0b50b84cbafa4ab22906bc629791a34fc16b5047417d46f0f83d50e14409ee3f2581cfe6d5d999f44074f26d24a7f1d3d83e8e626f697ba206cc5c25988ee973e77ca7f22c86f9beac0acee4d8fb8cb94718759ea2d9d5c25da024d2a2059f166e050f3c85828a4abf063f94d78c33a22433000dc571f2f1f4c7a4c625e09d58f4b3516521478716b662168a584d67ee7f9ac6bf5ad86a1bf65f63fb81822aa07f9"}], 0x23b8}}], 0x6, 0x4000)
r5 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, 0x0, 0x0)
ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r5, 0x810c5701, &(0x7f0000005080))
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:34 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x840, 0x0)
ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430)

15:50:34 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, &(0x7f00000000c0)='/dev/usb/hiddev#\x00', 0x11)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a000000000000000000000005543eda4eeb9cce81d1e9fdc16fdea82689", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
ioctl$HIDIOCSFEATURE(r2, 0xc0404806, &(0x7f0000000100)="33ef41b58fe2fea55629ce9e69016a16ab8a0b41159e1c058eb828c04bb46d0c0a1bd6744436157fd256209db39ef4e4d4cf4c1f08e02459159b54a950159ea70f36085f83c601270d4c1592")
syz_open_dev$hiddev(&(0x7f0000000040)='/dev/usb/hiddev#\x00', 0x1870, 0x580)

15:50:34 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x800000, 0x7fffffff}, 0x8000000, 0xff})
recvfrom$ax25(r0, &(0x7f0000000000)=""/82, 0x52, 0xc0000003, &(0x7f0000000180)={{0x3, @default}, [@null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1826.819674][T19929] ubi0: background thread "ubi_bgt0d" started, PID 19929
[ 1826.841634][T19924] ubi0: detaching mtd0
[ 1826.844235][T19924] ubi0: mtd0 is detached
15:50:34 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e766601a01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1827.537778][T19941] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1827.613351][T19948] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:50:35 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200f8000800450000180000000000739078ac1e00011fffffff03000000"], 0x0)

[ 1827.743020][T19951] ubi0: attaching mtd0
15:50:35 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="00261900000eff0700000000", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4})
pwritev(r3, &(0x7f0000001380)=[{&(0x7f00000001c0)="5fbb03c8c06ac84c969d6743ffa5c25c127fcc9bdc9d3648718997328150fd1cb5170dd0a070abe04c417458bdaf224944bf6dc5b1097ac365325c935e1ba249a55ac7808f44f52d57dd59722cff850d5ff2b720f01b80c03d3c46e7ff3c025e0211c3447276ba15a510a7307ef121612ec26c8a5dcc1d1a81810984d236206d1e26e460ca4c96bf66c0d98574cbf5943353bc65d05afb1f572889250a", 0x9d}, {&(0x7f0000000280)="8fe7e8424a3c84a6c50f19c60a5d19ae528ad971b473078789d21207e4371ad676084439a3dba2cef982a811b3003aa6cde8f8a37d2382db426a25e4ebd61877de8f7019f773013079b5492a463e8163e5b26a9669913d0794287d60c2818963096fd89615677661ef62f5c255454f3ccd058263", 0x74}, {&(0x7f0000000300)="fba4483fb8df538c94253713e941769d9f56e2f9eda89ad5f3e246a3aa5689a806544035c252f6f47d3c9b675f0038384abfa917eda3a0516505027e7ec849041adc88cff491ba06182d71db8a9834ee63", 0x51}, {&(0x7f0000000040)="b5a0e5d3e46d260a8e1abfd3c5739286975a6f6cc944f50a3c6ae5e387a1feb00752b76f9d410205abd11d3f0b", 0x2d}, {&(0x7f00000000c0)="ca00732515f32ea39c4a71558404b4e6ea556e659010c4d56a8b8519cc78b104fae06b2b2929cdc8136180f9935ef78e8072fd930318ef8d", 0x38}, {&(0x7f0000000380)="b266926ab35c26c9441c5b1a5a64c838cfa1ef876016e7678b4dd76e114a58cfc7ab596cc3ee5ae403b77d1fd81b1db6918bcf32471f0eb25a7d00e6fbcaba9a8bc31a9b3a86a2a84e495f3f90bc8398552e681e9e7df3ea53ea222143b39abf982cf389286ac4af546bbe20b603b6db0605a7931469fb81772ccb80144c337bf1346c4c620cf5263db12009cb3fe991959ab743cbce9954171898f90cb828ce7d5fede4d6af059d0189fb7bf7aafec6a01f07e7eb43477db8b188b2bbbb46e5a948bafe920f22f40114f8098394efc64b97e83fd064ca85808508ab4e93b8ca3193c14a9ce52658cc68a2d30947e1469bbedc20e182eb01cd5aeb955826df7e9b7a14687c61b7936ab229fc50587a458818276bf028281c5d787018802abfc45726c978ad6b9163dc1b35c0b15b87dc758cba7232ce4b7493564257918c8e243e1b5de23a2b562988d086451f9ea55c688545c3aded86dc4e1c3257e30ddf067497998d0389540b62327a923b3b279cf012e13db36fa84612391d29b71f95f4e39a2e24f4d7eb85e5819ca4172ab3a9dde096610fb75244630bb7a36c9d703a8d3ae3f6fbaa2126e83d50abe34d2ec56ed341e6d27f4adb90e3d09f254e33a6ccf55f3daa3d3a3bfbf54cf011bbf47e2f68f1d1eb35b0745a071776874bdef4e1271fb833621fd09eadf6e435e6c8a62e7f37efff3ccbfa3c398eac612307b40b0f5063b73bf258cb1250f5d2c20cc3053c79c56fce192631acb42ea82175b9516e776035f09c4e3151a613b5ca9c14495bdbb06302d9f6f4ecdf0a2b3ce1a0a8ee3dbe6d123a779dbc240b6af20d87b89c12ec62ad29ea2ca1c01473cf6758c2fbf0f91fd4b6cbf9a9368cbcac45afa8641ef9a4ebf1e05939a18bdd930aee47497ea52b0e54acfe9059f644d4d5277fb2cd7543028a4503e667976ed1c43f6cf87cd1e8b15fa18ec24b475ff036c569f5598274ef9575110b5e945f7d0dc7f1615c6a51962e9e464f0486a3db293aac738874a6a6bfb168c675603c4537e5b29bb554dee05ced267b10e2b670dd748f996beb86cdb737e836a7039c5eb546061c630e9f05d9cc8438b5865660e9a8d313f73ba6feb8aa0954c50bb118a8b50cbf3a0cd592c31a3b29b538c398e8c0503aad48c4ff751cd33afcf5a76d95cda80aa677968a5ba65e96c0e9520c827d5e850e1e41591407d189517c314a70a802cd048f4d1940939c569e106ced15f071ea66e02248f0144369c2b6b77b709cd571ddcc65354fcefb8ef952e76470807b01bcb1737782e70340e7ea82d2f81342dc9408a19a2c12168a2c8736142d2dc4b2bc29bf6f8eaebec0192e543ff7aa5c02835d0cc9faf7a78b9e99cf861afdd9d29f10d9f9dd41d86478bba638cf0dd4da977c4c912ba532056a8c8af0ee15c649fdc40c3125bff9dd1e7c8026ab6aaf72906795a8f4a07439e28b50ca2323194703368de9e06ab054d8dad48a07b59d3350a179e03ab4a05644d6c7a696d71efe91264285071d2252a03d84a18cc9e870f2e1abe4d014caca1e32dc7013c44ce0f9a6b3618598e0ed42210d5ac18e8cafe8c55a33b1df1a227f243f3e0e75e57c93745d673f723f51854731e2a7665ee84a9bd1be962265ea7d77815390baf8b12240ce3e2c43bbdb99248fc905196eb8c029c3adee20a3274b52dc905ab1b055c8f7b5ca8458b4d69f9f569e6cf028b4abdbfe753a8858f44dd6da9aee9f0e7bfc2749fea9533048167b2dda7561465877cb1e2da6dbd1325abd8f7c604fc0a24fdb7fd6d62e8c9a9cd95d4f305b0d431ae5756cd3b38144247e6db6eb145f08f404562a1d05abd3cd41095e91158576b154ccbc8827b9b4db7bb6fec4b42926a8f6483992a37a15b7811cfe8c4873d35270069e732d98323556ae61161b62545b79ae631bb84a72ceba9092b619e0b0ee98ab8d2d09d095739882f60295a283eb8fc413debb34df2d313ce7f31a352088680621827b9bf58949df19a3f8a00c310f9b47db695c62e024e4162139c49e28b8cb2ae48bd97bc4eb311246649e7cd70282d8b4c0a9f5a37c9d4d385c7fb5e41610f65d21af52e70c8d6b8eddda8e95cd23ee8a7ef11aab05514b36c411eb47615d99cca5e1299afee09d5af0630209eb42a114a91bb91ddd8f8890a22b55aaf175abe9ecb9b821d3ed8b7df50dc96dd955031a91749a7279bd64604816e26601cd5021c490496d9cc8235b6ae825868b4ea9fd608b326f82b4860b998ec0a3f48773dfc5a8e5a242720a14529271975ea22c5d6c0bb7afb57d59cbc58ef2bbf121a2038ff22dfd1f84b4b6cf61e3e67c828cf8dd5ea96f482389aca0c8f2256570ffc77e1178b6f4d7d2bf1218c746caee0e3ea4ce3c320dea6ce38c6893edddf36b5ba5347a95bc94f8da6e19be44dc1950c2c5781b9dd146f2a0d2138742323534b8cfe22919e3baabc21ed81229427d50689d72349918ee35d2edc6252a668bba11f0696f922c59e2052f75332c16a089dc87807b4e29c7e5b6c9a9232ccd9830c1b8d0660bf96dea3940f8f34c5fbbfa049dc3585878715a7ca5aab8a56b4f8f8b7386c2714d13ac036fc3120ab0ff77a4520da7c59a773d84a1c260f0a4b8f485cf93e6effffe14d5cc3bde9c23ca5ea26b5f45be0091a2662195ac570dcb75dfdeb030351c6b686d2bce83f7111b3fa7ae63bf6f067d15ca3b451338b3380ab3b19139252646e73dd6c670e86d9e02a24294c8fad2f3631b33e56a384d68613cd7d60393e06e018746e0c40c9b400f24a5180234264f4a12bb1e0857f06a4659935aecb41fc848874256ff16064614f0ecae0f5a55caaec5f83e617b306300cb0492fc7d7932922d73faf834c6ad67236e52499476437a1bcacd9eebf7408514b60345667f3b0d4955458026afa54df16bad74e3a846a646b9f5dc0a5c55191bb4f0aa64e5e4003756343f86c95ad90e7d8d32c7c2984a70145b0b746749cc1c867ca8a5a538d22ee7a4cb4b3345cd9da088b0c37f878eb70121e5d011cfb34a5b238018ac8b0f9774eb0386ac11e607537923a9f281ccb1830e3584c5623d0337f8d05c3729d880b261cc9e865d366b3ee401bbd9ac5280cc976a6570e17dc74a27360b6cdd07b6ada47dc9da79c5ce478e86b910393ac616399bb52d3e439e16d31521b9da051a749e0584d97c6224b73cca34d7a875e950357b6487060e920165640431288ac0ddc0842b6a3fa2a49941c40a68e5161e9606e7d52732080c58e8e806296f1ee93588127a0447034a8dd2a016ac71dce05ddd88b35be35d1cd395c6579e5409c41fcb1f1f88acbeb68ee889c3521ab6eefe7c5fa512836bc977ed1f5f21a59e79e647872215f026539c01cad26d8bef9bd70bd098e46407856d0693aa3169c1cfaff56d458b0bd3500eb37bf9890607b4412d906ed53c9c598e15ea70bd9e843b759618e5833c068f11dfbd6ad375ae7a42125270577ae205ff24d300baee821ebcab338d2fcf83e82690e6369c0e43294c5afb8a955058a47e77c3a32479a665949930add16ce5f201d6421c9ecea4416087d7b9bde42f14b6f161f07bbfe64cb0c11ee90389a85027ca5f37f89544bda648f8d294cb7b797b9dd4a479696d5cff5b1283163657ae245b1d0e557481d9073ddf02e44ba196a47986bfdff5f91f365df48ef970d349cbe3ef1c214c19020280464f838878c2488b6602f5e54829e8f6b0265379a7d91cc08196a29cc1684784327f639a05dc57e1684a0d7ad444e158327f3e31557332e1e93cf1d7b07ac58cffca9ba4278740b81861dd893e5ee981b35ac8ae4a1ae7c1ddad09070f9897800b7f2f4f588d0bb98563a2a5a3961e0e5e85b62418838dafe8528749a68340a17b445ce219df0ca7a892c2aba6b7144fe0a79c7b58ac1da221b624f02a2a73c91df5100e701dead2327946774e57a22c265d17f3506ef8b8ad3b9cce3fb3e31a268eca8051f3785dd5cb14ff4cf2612412d24b5a9ac3080156e5deb33083959b1040c15ad56e813a7cd6e95a8ef6770dc2b97e477058d26eae5e6855df4955b2c17b950702d5af30e82144ac0df7c287acb18e252c12030d95cfe80c03df2fcfccd8585c86ffc204c7aa06c185f6f159fe37c766e592aef7f815bbea5b3222690b8d639c4e2908f9398790fb9bd045e4ab8777595ab670ca7b6a7c93773cda4926c5dd3478c2080620fe52a881f5e01ea2207055a3f48ed68bf2ee91407ba2efa742e9bdaa8689215919bc49185578aee706503033279387a03198c960e8e4a5beb6e339d4e6c20812de55a82c9fc18bafa131169e81fda83c06eff4f19169f49d7ed8faf94f93ccb867291eedfb5e16a7555d4e6978835f9472da5829994c5dafa723a4fe193bcca47b5e8518c41cc648e2ada74cd744c4561ba58d9bef7d4fc77f9eae5b264a335f2a1d4ea18f0a739bc4053d582aa00e67e0b68969b440ba59407c0a9ea8afd8b20e395568033a4253e30faf0bab5ae0131c1e879a8d34d15be38268fc8a0c35b7d80bb50a918f16f805fd37e6190df7155ad4aafd9d518c342e0fef1ca341d7cd7150c5bd60338b6f7a3e850e9483899dc39a1310c879139e05bb7631fbd6f620996dc3d622d3d46fe6733e31dd68735d4bf16dc3dde2777882ab78b874e0abe87ebbd6284a6998ff86652e53bba8a0b51ce66441c320cc0bdef18aa4aa3b820bdfac938b10a0c77953a3f07d86ff7b1e40b1cfa12d9dda5b0338772e75202bf1561e81103de92d054b227b511cbb5c83c86b89b08c8e3abc59f11dc537aa773d9c92f3e43e1ba4acdf73ef1c53def76efcf85d0184aa300166455631d18875da7cdf037bcbd8538da49b17cda7aa06bd90c169d8fe9e4b82143de51e8de5d7b7fc76ad7d129af68ada2af3c1cef9ba941f2deaff5f4351918d0d000d9549f5185a07e2a2c025fd3dc2543c0120b0d6a7b57d54a4ed2f0063c7d7c585d1994a34a384200a0122784a656ca008e0f2ce0bdc84c8f5f88bde62d382c26839d6a1fbee468c3d09c28efeefdc062e283f5c16651133130393905dddbaddf05bc2c99f07c4685a21e2c3ed7c33957e3280c674fa71ed0e2d00470963114d7607a85995db89c9251adb84e1ac336c9fc1fdc15d8a207f69f4e2a7e3e984f7621324ce3bd871982971173ddcee708f9fc2dfe67e2d9184854e32b92385d96c3faf1f975f981ae558609b51865fb4aecfb4311ce8b5d4089cc82987fab049993008734e811c16da2ef5c5e72d30bc89bd62513cf35c8a129cfb6162752988851a0b0258e4b16ecf7a09d2de1596ca652bada3b1d5cfe47096e37b7e3ebaccf3e4b1f863e5e00be657df2f82e37277e270dfb1ac66532b1fad3ed37e5ccdce682a1516aaa716918e59850f83e3600b68db7531ecfcd099432a8e96f6bd0edff8aa6f000ccd662acf93468e030a9c62c87273e5608d3a1bd531d33481c9a8f265905529a15fe1bd480fe1026f2e7da1422bde7a06a486484da7079154078c24ebe1806ce63f196049c9d28de22d4817d8b30ab4d9eb223db25c493e231bcd78143adb44ebc62ac01c952516ac0dc67557f33e2a3ed71068bc13f63af655bfd7e224efe022730636e44685f52ed31d2b9ab6eb65f717eda5c666bc3081401e4d81c067da8fd886506e50b8a00d41e818a4d9f9027154dd0e7053243ad4455aedfc37b3237d2db5d35f3c6f360822d9d29a9a8eb7b6f4a64ae4e4f52bb2972057967055b769a8dd00a93148345d5886c08f3724cfaac9d40190ee9dd6", 0x1000}], 0x6, 0x6)
close(r1)

[ 1827.789637][T19951] ubi0: scanning is finished
15:50:35 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = gettid()
tkill(r1, 0x1004000000016)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={<r3=>r1, r2, 0x0, 0x10, &(0x7f0000000040)='#)%),\xbd!{$,([[-&\x00', 0xffffffffffffffff}, 0x30)
syz_open_procfs(r3, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:35 executing program 2:
perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
ioctl$HIDIOCGFEATURE(0xffffffffffffffff, 0xc0404807, &(0x7f0000000440)={0x2, "dc444235f20c920dcac27c3deae278f74063d5f0fb8f4a328f122173983de8ebf2265f1c150b18a04593004634dc3f9f2fcbade6259690588c359c6ebb6e4b24"})
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
write$P9_RSYMLINK(r0, &(0x7f00000002c0)={0x14, 0x11, 0x1, {0x20, 0x2, 0x7}}, 0x14)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
ioctl$TIOCSBRK(r2, 0x5427)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0))
r3 = gettid()
tkill(r3, 0x1004000000016)
pidfd_open(r3, 0x0)
r4 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x18000, 0x0)
capset(&(0x7f0000000380)={0x20080522}, &(0x7f00000003c0)={0x3, 0x0, 0x40, 0xe9f, 0xfae, 0x7fff})
r5 = dup(r4)
getsockname$packet(r5, &(0x7f00000000c0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000400)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="ec0000001000010800"/20, @ANYRES32=r6, @ANYBLOB="000000020074987311c24cd991412554801400"], 0xec}}, 0x0)
syz_emit_ethernet(0x23c, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000008004709022e00650021092f9078e0000002ffffffff8323e6ffffffffac1414a8ffffff000000000100000000ac14142d00000000e00000018664ffffffff0710f9b76643bb3de7a564c2e2fed3540303f6050506892c0202060ffb6f8ee8888f3dc1a4956b47d601092454fd9628d14a070f9506142df9ed005fdf326e35c206117c9933fa33ced4751a88f533f9d523070c8d5fdf545e2500090000000421880b00a80000c9117b8c643bb1a3f29b9e8f607cdf2ea45f4e3b7a5a697b0e6ad481fb4b48a086522401df7cc4dad56066ef5d6d9af241b33ff3c8104120b6bbeafe6826713225d2e8187dd42bb099ebce3ed53470cbd703503a5df55573afda6948da7542557a3d90f3a9f85d22c32ee954527e770c1d5fe8f3e6321ab429becf9301b4fae55aa9bc54c28372f1e262471e5901385325c6c6eba643d8d405b9246c2b0930e7697ffcccaaace10500080082b9734247772d24b6a1c6762f6ef6ba9fd5047e36014213935ee7b403a39652c7a8c6764115c9719334de0f7b659098409e11ef4877090086dd9646040214080088befc085f9837bec9da4100000001152038070100000000000000080022eb000000032509d209020000000003a51f0800655800008002df5874e9338cf7be050236e1ca3cf209bc5561cc1b4fc1494dac8c6b838734489ed358cb9b0df68311f09ccb772eeddbe6cd9095307c05e90af8f55cc9d36ad081236fca272488d965d0705cbbfc43cc2009eda5d088f5897b45a850c5c24e3636aeffd1528b15289f25e61b05a551b2ead894cfc57700000000254e417df6c45608e27b038e0f1ee839e28474093bf71ba811b86edd0131719d8feb7560989c28ad5ad2ae97be43af4bd4562671771dbf7357f4f9a7f4431088004c5d6288122ee111813a0e6971e0d2ebde428ad193a357c94aeb4a40974cb00f22af90c7f654c879738bc6fc03ee7bc835aba585d4d3daafaea279d9a02de131422bb9146aab17faed8779ef21596f1ee16c7a0534dcf5f39e26e8b309bcfba4491855fc3991986cf2"], 0x0)

[ 1827.919448][T19958] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1827.952615][T19951] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1827.976452][T19951] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1828.000883][T19961] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1828.004660][T19951] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1828.046682][T19951] ubi0: VID header offset: 64 (aligned 64), data offset: 128
15:50:35 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x6440c4, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='/dev/ppp\x00', r2}, 0x10)
close(r1)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e)
ioctl$SNDRV_PCM_IOCTL_READN_FRAMES(r3, 0x80184153, &(0x7f0000000440)={0x0, &(0x7f0000000400)=[&(0x7f00000001c0)="d5f1aceb3f871c7067509835204251e4ed57fc703f1dfbefc01a6c13026a275cdfceb7759edb0256060d85603100ee448c3b80535418010f736decddd6f2a47f8f2fe425cb7d8f73fd4655fcbd3f35e966", &(0x7f0000000140)="5960075b0bdb6751e38872a2f2f0667e98b93d7213e97153d065bb", &(0x7f0000000240)="98c15c73b8f76809e1c9042934a0d56b91d47efc2ad232e5bf94a4123c6f7b458de07db97d19393088664b196663b0af5cbe600396d8dcda2353ce8fc06b9751248165615f9ea43aede089960d0e5acef89489ed4a9f60e0f244609dcbefe1b66186e546987048d95507a2a7034b06b1c7c10533362bfc9a2260eeb696ab3e66b5cee97b8deebb70a78585a85e17c34173c64036c6993b9a498eba41708d25e38d81747c9cc6ea0af3f1add5479ca61401afda730d98ffbc85fb7da1cc81", &(0x7f0000000300)="f02ec1679ae0b6f2df4b06778bdd6b32686d11a8514118be26e22e1cdac10a25c7ae0c8dccb7b89155a698518137a88731e93f6ed8dc89ae44ec265d2e7ade5ce294b9d22ebde7cb7550955139c0d79b451cfc26ddc7059978675fc19ea466cb3fb20ac65070e56fdbab9aa0736d59127070d7c54f33fa5aee8e79c2b4217e8ac937023f0cbfb55ce6ee81b5", &(0x7f00000003c0)="05be0715ec26c96c178fe7d6275c08f4d6c77f86e8905d617bdfac897517cd11640b9f3663706cadd843bd4ed0057f28edc4cc"]})

[ 1828.101512][T19951] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1828.133544][T19951] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1828.173789][T19951] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1828.219512][T19951] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1828.255278][T19960] ubi0: background thread "ubi_bgt0d" started, PID 19960
[ 1828.264078][T19971] ubi0: detaching mtd0
[ 1828.290640][T19971] ubi0: mtd0 is detached
15:50:35 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x100080, 0x0)
bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x5, @mcast1, 0x1000}, 0x1c)

15:50:35 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000240))
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:35 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e8dbd4dd4864d800c673950e05f4d0e55594a783c13d3e58467a87730f37a0000fffffff30000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000040)={0x2, 0x8c, 0x5, 0x1, 0x3f, 0xff, 0x80, 0x69, 0x99, 0x2, 0xf, 0x4, 0x7f, 0x1d}, 0xe)
close(r1)
r3 = accept$alg(0xffffffffffffffff, 0x0, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r3, 0x800c6613, &(0x7f00000000c0)=@v2={0x2, @aes128, 0x2, [], "9fe2552c12d2ba9cdee914ee2f6b98d6"})

[ 1828.611796][T19993] ubi0: attaching mtd0
[ 1828.635922][T19993] ubi0: scanning is finished
[ 1828.694212][T19997] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1828.708988][T19999] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:50:36 executing program 4:
r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0xdeda3da7d5718f24, 0x0)
getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000140), &(0x7f0000000240)=0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r2], 0x40}}, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x1, 0x3, 0xff, 0x800})
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00')
sendmsg$NL80211_CMD_SET_KEY(r3, &(0x7f0000000340)={&(0x7f0000000380), 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x6c, r4, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "5decb7e28d"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "5aaa47b76f5567e5644097289e"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @remote}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "5915e41f19"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "596c5d8023bddd1b582d5fba44"}]}, 0x6c}, 0x1, 0x0, 0x0, 0x1a0}, 0x4008001)
close(r2)

[ 1828.749307][T19993] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1828.769187][T19993] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1828.808515][T19993] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1828.824909][T19993] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1828.846381][T19993] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1828.869035][T19993] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1828.893733][T19993] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1828.926766][T19993] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1828.974016][T20001] ubi0: background thread "ubi_bgt0d" started, PID 20001
15:50:36 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='attr\x00')
sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x6c, 0x0, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8081}, 0x24040000)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f0000000780)={0x6f4, 0x0, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}, @NL80211_ATTR_SCAN_FREQUENCIES={0xc, 0x2c, 0x0, 0x1, [{0x8, 0x0, 0x80000000}]}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x0, 0x80}}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_IE={0x6b5, 0x2a, "ffccb4d6e4d0629c348210ba5f99cee1e111f43d125b8901229ea2ef1b80f13d9ee216b4dd4491dc8fe4d4ab914981de92915c2ec7e0e349f7f0781962fc775c684f2ff55dfb18c1717b50bd5110002f26567ff5b65158fb4890567c4b2c3f2aa4581a0343556ccea37f199c24a2d1fdf04f8e5c6480ea9c9dab3b0867b2f01836205869d4afd48ed92a2cd5e059378db128dc95e75f55b754a7446454cf90d389960d7b5066098ab3654cf40657e1cfdb03ce93892131ce0f9ae82fed23a5b8420ccef2fc3b152b257d4b24f1490a94a7ff80c46cb307920440a2804208ecd1fec394f923808234f6037cdad3622f938dcab82bf4403e1b68cf0a8a1f3c32e4066c8f6cef81767dc82d345af8380dd93180ef61aa5b9f19d752052b5ff1768e26c673e1719573556b7c206128a625580213fdfa283100d8a589041ad7a93b28d77afbdf5f21e1f1fc916081b0145eda252a0dcdb4f990a583271142717ceedeb5e50d53a70cc6130ff04b28ca41f3e398e67d1229fb7c32f120cb2abcb65cb717bfea9fc8d9f9c8233c58a8d91a26a833f45a8034208f466a8de3bf2b97e35ed5b50b9559abc5d46b745d579cb37eaf485e39c9099e5c4cd0c725f1dd62a23fb797af3f7cae69a01c69c6793a2f1160be046165d6468949bd8534bf593ddb95c2d037a586bc317f9e5af82b83eedad88586f0cd6e8f5305c7abb4610e42f048c87cdb022fcbee757797ae3bab217762ac819da10bcf56ead0150d5ac2bcdccd6b2b7d7767843fe5287e91d7d89b6b172a842effe042be56989a265f2cdeaee1e4d1c2b194564e7a51ed516bd62ce4ffed957646495d799007af768706bc135ea7da00f29d1696c42894e271dc3f5dcff0aa221faf310ee8b2b2df67a9bc7f92c5ae9a5b57bad80b16c6cb5c743d94ee4874eeb280ac23f1b89c56bba451768ef862e9b87b4ce201c2bb4b35cf2bc709b455abc2e6b1a60d64c2f0a883dbdd220862627d1e756dffccea644993af5f928f46f414c0664b074b58722e2b2a474781176d3615abd46373e95a151991ca8cbe9f651f04dc738527e3be4dfa14c2636e93014034781a076a13a0bbb8ef12cb4b970f64246099fd1060c69c5f51daba6e7b7499dc21fa7c671b39ffa4cd5183cdecefea2a6f164325caffd3e0c46d6adabe7d527f6377b4591574f9c15b723bab9cfcb7f1d272b6495b7770a70810ea6c7d0265c7bfdb41bd3b0a6fbf149644df963bab4d3d2f6d172ec0426252ce8496648c94b422867a65d213070ece1582a6c3a9c38c57937d951ae1a306af656c6844544dd3629d1f82191d07d0032c9cb9062f9eb20bf26629d3fdbcb1be0a7deec2a953ceacc5b6feb0eabbea77be750986758b789aa75e2097142000ef66775179e6bceeba2e6f43a4014b4852d37b3cdc97a157a5f23ff057a986acfcefa042ca34becac9b1dffa853a5a0078c30ac2a85c0bde90c4eace8f057d1d5a2fc963fbd68b138d01b666d7d900cb70b298bed0e14adf666ab8029bdb933c7f621453049176a65ceeb59d1ef682c2ba9df2f1ca8cece1d3683e5f0e76823cb1a33ab7879f2b82e048e94df89723921f6abd6c091e0d341ea9ab57cb96cc2c9be101705c0ea22f8c2258eca80598dece69f808c5636dd772791f148b3240e6bcaff95368753d1adad1e56be685b7d0eaae5302df8a9dab4cf2a4cff8a124c3e462d376baf8cdb448d01afa0c44d9fb0f8efb2711e25884dd957768dd1893776a0a8424a4e1cc4650a6bd25ecf4885d95deafec3f2b666811abe70b9a60a69cbfe0cbdd269413ee39a6b4fa3b8c78b17305a4f6ed8c1b7070d715a1eb2ebe36dd9bcc6d24257b804b9090d432d9982c7decbf0f571097f15e944c0fd905052a13b833b02c06f7f6b4c9dea15cb1f424070b20b3b92395531ae216985c6bf196841d0c85f20ac064fbdad352ffc92e724e7cefd1c6ecc48c1cdd58491494f6756ddad939e0a2fb2e2f9b11c790ca3a997d1faeee5f47391146cf4823eb7ce55d4b3943b68617e3d14e27d3348985f39c58f75b96502067108c911b40e3572dc0e0d51ad00444525d868eb0e0d96860395a28416ab265460ae4b6e749ba4fa72bc993245fb4a5977b0b57fa4a7ce526628decb148cd676e24dacd3cd8068ffa38c30147f3408dffc806302e0129a131a9c85b99d10dc4461fe09fd088f7f73d36bcf1f467a0405bc73527d5c68ca61836f453a452e2af9e1628aab028e952da8893f43e38f613fe5220cdd8f110244d57fd8ef40f47ce5e9ce8f3ba354ae25ef114a84deae878ed5f04f9dd9bd3b76b6a5a8fe0b4e2fde95129e5a963577de788a217dfeaa851ff518dd3443022146067270698aa1b2b816299e79dada22406b9fb9173b37fd6ee9600fc6d671a6e3f9ffa3e2a0e"}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x80, 0x7}}, @NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY={0x4}]}, 0x6f4}, 0x1, 0x0, 0x0, 0x6ce17b06f5f02e26}, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1829.042429][T20008] ubi0: detaching mtd0
[ 1829.085508][T20008] ubi0: mtd0 is detached
15:50:36 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x8000, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="000000008cf15b7aa20000000008000a00011be63ce1ef29ec7eaa411ca0d84608d9d04457bc0de33fa94a4e0b92fed7d30147b7cd2a96a61905d8caa159fc1eff606b688d24906d3f112484035cd11f0d582eb52c20fb14b9701d4f13b01ed7fa6f2f11bfd88834c851730a3d68a6fd16fe9206ef", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self\x00', 0x400000, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
close(r2)

[ 1829.359777][T20023] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1829.431798][T20027] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1831.906818][T20042] ubi0: attaching mtd0
[ 1831.920862][T20042] ubi0: scanning is finished
[ 1832.590303][T20042] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1832.720457][T20042] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1832.731048][T20042] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1832.738065][T20042] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1832.745817][T20042] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1832.752789][T20042] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1832.761000][T20042] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
15:50:40 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000240))
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:40 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x10042, 0x0)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$FIGETBSZ(r4, 0x2, &(0x7f0000000240))
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:40 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000000040))
close(r1)

15:50:40 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
r1 = openat2(r0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x40, 0x19, 0x10}, 0x18)
ioctl$USBDEVFS_FREE_STREAMS(r1, 0x8008551d, &(0x7f00000000c0)={0xffba, 0x3, [{0x4, 0x1}, {0xa, 0x1}, {0x1}]})

15:50:40 executing program 5:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="d6b1b3547ccddef110e1656679c91ee9e7697d7c054bf822c2b6e3361930ea01f80930108b5929f46072a25300f3c6b5e4e3c9c7f3f15d6e74c7393fbca81dc209006d52d05a791d0e21160367586fa5d77bbf9d3072f81972ac89e34040d100f6f11201fb7865c739cfdf1ee0f3973407c173e50fd52a4ba3b699d1803d64267c68eed2edfe8f7f7bb7f98203b0f40c36e53ceaad05412f3c594f8f86b4edee6f0fd3a8c257f1529bbfef45fa3bd6c365123f9b9d54ac06cb18a2c2cea9929bcd1523bd80f3c7120cebaddb3bc28820b89cd6f7ea84", @ANYRES64=r2, @ANYRES32=r0, @ANYRES16=r0, @ANYRESHEX=r4, @ANYRESDEC], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:40 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_UNBIND(0xffffffffffffffff, 0x40106437, &(0x7f0000000040)={0x0, 0x2})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r2 = syz_open_procfs(0x0, 0x0)
r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f00000018c0)={0x4, <r6=>0xffffffffffffffff})
dup2(r3, r6)
r7 = dup(r3)
fcntl$F_SET_RW_HINT(r7, 0x40c, &(0x7f00000000c0)=0x3)
r8 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r8, 0x40186f40, 0x76006e)
connect$pppl2tp(r8, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x18}}, 0x3, 0x1, 0x0, 0x3}}, 0x26)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1832.771217][T20042] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1832.782049][T20049] ubi0: background thread "ubi_bgt0d" started, PID 20049
[ 1832.897722][T20055] ubi0: detaching mtd0
15:50:40 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000180000000000739078ac1e0001ffffffff05000000"], 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000018c0)={0x4})
r2 = pidfd_getfd(0xffffffffffffffff, r1, 0x0)
ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0x0, 0xb4, 0x1, 0xa2}, {0xd87b, 0xca, 0x9, 0xffffffff}, {0x3, 0x0, 0x4, 0xec87}, {0x7, 0x5, 0x40, 0x5}]})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$KVM_SET_TSS_ADDR(r4, 0xae47, 0xd000)
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e)
sendmsg$AUDIT_TRIM(r5, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x10, 0x3f6, 0x20, 0x70bd2d, 0x25dfdbfb, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20008025}, 0x810)
r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2100, 0x0)
ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000100))
ioctl$TIOCNOTTY(r6, 0x5422)

[ 1833.050597][T20055] ubi0: mtd0 is detached
15:50:40 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000240))
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:40 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x500, 0x0)
io_uring_register$IORING_UNREGISTER_BUFFERS(r1, 0x1, 0x0, 0x0)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:40 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaa000000000000400200000000000000180000000000739078ac1e0001ffffffff03000000"], 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x6)
ioctl$CAPI_REGISTER(0xffffffffffffffff, 0x400c4301, &(0x7f0000000000)={0x6, 0xd1, 0x39})
socket$xdp(0x2c, 0x3, 0x0)

15:50:40 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r3, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r6, @ANYBLOB="f7ff00000000007700"/18], 0x88}}, 0x0)
sendmsg$ETHTOOL_MSG_EEE_SET(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd26, 0x25dfdbff, {}, [@ETHTOOL_A_EEE_ENABLED={0x5, 0x5, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x60048009)
close(r1)

15:50:40 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1833.634626][T20129] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1833.662345][T20131] ubi0: attaching mtd0
[ 1833.691982][T20131] ubi0: scanning is finished
[ 1833.738293][T20136] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1833.812924][T20123] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1833.846817][T20131] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1833.865336][T20131] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1833.889467][T20136] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1833.910174][T20131] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1833.942599][T20131] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1833.970186][T20131] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1833.994929][T20131] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1834.028026][T20131] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1834.077133][T20131] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1834.106404][T20151] ubi0: background thread "ubi_bgt0d" started, PID 20151
[ 1834.114198][T20145] ubi0: detaching mtd0
[ 1834.221710][T20145] ubi0: mtd0 is detached
[ 1838.169786][T20178] ubi0: attaching mtd0
[ 1838.204748][T20178] ubi0: scanning is finished
15:50:45 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e766601a01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:45 executing program 2:
syz_emit_ethernet(0x326, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @gre={{0x2c, 0x4, 0x1, 0x2c, 0x318, 0x64, 0x0, 0x3, 0x2f, 0x0, @private=0xa010102, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0x2c, 0x64, 0x1, 0x1, [{@dev={0xac, 0x14, 0x14, 0x1e}, 0x7f}, {@rand_addr=0x64010100}, {@empty, 0x2}, {@dev={0xac, 0x14, 0x14, 0x29}, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x24, 0x80, 0x3, 0xa, [{@local, 0x1}, {@private=0xa010100, 0x3ff}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}, {@rand_addr=0x64010101, 0xffff}]}, @timestamp_prespec={0x44, 0x3c, 0x92, 0x3, 0x2, [{@remote}, {@empty}, {@empty, 0x4}, {@local, 0x9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}, {@local, 0xa7be}, {@rand_addr=0x64010102, 0xfffffffe}]}, @generic={0x0, 0xa, "f8c29c4fc74087e9"}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x77, 0x1, [], "91ef87478396e4f77cffece5a9b7515f93342fd1b94c160c193d1164883a077ea9962ddbaec3e21bb91aa64bd60c4872cbb1cce5727becc2fc03e1030947a0655dd2fba440b1fb1f7610e8b32a8ed059ee2d02bc6b18a48a2b3f886d3600ad712addef86d528350e207ac64c437b37e63f51f3b4175e8d"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x6bf], "3edddbc725aca6e494b205f4f67f3c46d41875e10c0c2439c288a0c5dfe5174b9ee37385c390bc141d25f5151cd46e4465f1de99de3f93e98fdadf2de6"}, {0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0x1], "378abc31635540d996428fa9c2b9a4d343e73453ac313c37bb73a8bce14ca969923ffcc0aa14ba47c833659084f6c45b601c39815f3f1ffedbbe233537eafbed14e6fbb5727d97a0c5f76a22c19fa9c01262ad82997900a7e75ff2a54f0045f36729fee43b85c29822a5368882eb98c95e98fe1626a228e02b3c9e82d8ecb6d95b5c1a33c23abea257f1b7236d992c6bf1e6b4568c781b1dab69abca492d7afa9755e045c319e0b00108edacbd917245ddd90433aea4d09ce9aeec90cad6f14e8ade17d738a1ab5704afe069ebb0ebd6321f1cde889a2665caed1b27190968b240d7b55b3ce2"}, {0x8, 0x88be, 0x2, {{0x4, 0x1, 0x20, 0x1, 0x1, 0x2, 0x6, 0x5}, 0x1, {0x3}}}, {0x8, 0x22eb, 0x3, {{0x0, 0x2, 0x40, 0x3, 0x1, 0x3, 0x2, 0x3}, 0x2, {0x800, 0x9, 0x2, 0x1b, 0x0, 0x1, 0x2}}}, {0x8, 0x6558, 0x1, "12ae1a7273df4cf57df592268e0d8ae38dfd150c1c8893a872264cff4c222a91f836cd03c7071ab5c8d00fa71f67f3b7b11e96fbfa5f6c1342a242c7fae4ba48a8520a8f8d17858fd423a9be8c84c7777f467ff7d9adbaa282a2027829198d045c5293c8a072ab5b552aff026072a8452401666bfc1dc99f64f4979df3940e279a0126998272"}}}}}}, 0x0)

15:50:45 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r2, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:50:45 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a00e771376ced8329f7d00617ad297b621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b73773fe9be02739d6185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fdd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d0100000095df1cff25340af4fc990000099fff70b24f8228bd07"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:45 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
syz_mount_image$nfs4(&(0x7f0000000000)='nfs4\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x4, &(0x7f00000005c0)=[{&(0x7f0000000240)="4cfb4281958091570310441035f5c9c9713a4e2643ffc210cee00bd291b39b041b802cee6c27b05d57c7c22772d3e1bb6abf241af4b632802b33b21d8255806ce01dc0d35782f6b3cd8816a2fab41f9bbb83e21a89403fd61a01a5d5ac8571c35f92126f21e87b6a", 0x68, 0x100000001}, {&(0x7f00000003c0)="167c4adf4d1ba46e35f72fe1430770c9b88ad57857ba54d771a1047ca8695427baf32544ff0cd2bd1cf0addad644041b294640ee65b68aceff047c874252b9bc626baa1a094fe4bcedfd9af295a0b9a839c37d3b099478525fc177db20537b9a23cdf8297689114b258460d6ba272e92f79a05af0a31ed6531833e5d5eb9961b2e6bcf843c6f7d1cfc4bf7cdbc18a25d73654a4c394b8d7dc0d050719f1fd8b4f188b7182455cedecbac6b9b6680061f0ba82e96be94823838edbcc6f097a61285518f837092fa72f04c994563e1139beedb4523020c1773cbbf8b074ba7e0b7a37b08d75a22", 0xe6, 0x8}, {&(0x7f00000002c0)="57f61b1a57dc48beb621e90c669f68df2cb0f14706d3c970f3028f293ec50c67f883cf838666ca28c32c434cd93f3fdf13035afbd8e566bda37b6c5d28c373c2cb36f58cef279dcc4380c6432e49ba283e13346f1ba9d998f02eacab48021b70cf48978523c6b266bd90c83bb90067973f", 0x71, 0x3f}, {&(0x7f00000004c0)="9e4aa5871a8e976fd3b82434d0172a386a3f5100421e4085f1b0ba9f12cfb167a675b91de81ee7a4369802da8f110320b56a894098dbefb1a72b05bb468ec1523fa34fa800eabdc0f6dff53abf2baa4ae5a235c033d67dedee027200ce5babeb675d78a63433c9d9b4247d00351b0856bb2f2ad76bfd1d947e35f75274509750dbdbbdd1ef70b3f3dcfa25118869b1250a66fe0909d53ac8306a419bdb0bce8402f5def85203e448311e3673fb79ce4ac95150b198ed226242f39d7a1dfda8ee5ff66a5b95c04cf4211bce30685c70700383002278935e86b9d8a67867dca35d826c18dace2bec9ea546de3d915503efdcaeae27", 0xf4, 0x9}], 0xb08810, &(0x7f00000000c0)='client1\x00')
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f0000000180)={0x1, 0x0, 'client1\x00', 0x0, "7a85689b160898a3", "339e49f452eae913daff123f093cd7c2a451277e5ba67325c454dcc82e9380e5", 0x1, 0x24000})
r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001780)='/dev/vcs\x00', 0xd6e81, 0x0)
recvfrom$rxrpc(r2, &(0x7f00000017c0)=""/13, 0xd, 0x2000, &(0x7f0000001800)=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e22, 0x3, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x2d}}, 0x8}}, 0x24)
r3 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
r4 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r5=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r5}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r5, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000640)={r5, 0x3, 0xc1a}, &(0x7f0000000680)=0x8)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:45 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0xff, 0x0, 0x0, 0x0, 0x3c43, 0xc0200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000180), 0xc}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1000008}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f00000001c0)={<r3=>0x0})
ioctl$DRM_IOCTL_GET_SAREA_CTX(r1, 0xc010641d, &(0x7f0000000300)={r3, &(0x7f0000000200)=""/194})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ubi_ctrl\x00', 0x4b2281, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$SOUND_PCM_READ_BITS(r4, 0x80045005, &(0x7f0000000040))
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1838.513284][T20178] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1838.650485][T20191] ubi0: attaching mtd0
[ 1838.678282][T20191] ubi0: scanning is finished
15:50:46 executing program 2:
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
sendmsg$NLBL_UNLABEL_C_LIST(r0, 0xfffffffffffffffe, 0x0)
syz_emit_ethernet(0x26, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200e1c75c612fc9430400008cd500739078ac1e0001ffffffff0300000051fe660bc7fd2e1e6f7eb358479357f8621225bcfce4689f37575295e3063dfeaf619f3915ad06e45d247479b8d5216e398a0e02e4582d076614c3192e51b044a78364e662da500063004bd5f817603f2eeb06caf56b6a2408aad80da529b2bc06a2717f000000a4f977ccf9551e9c17bd1317631cc261fe846df5d94eec28ab2e8714bc5e123190310210f9306f8e5de5a4e4a0111a95b4bad576c4d969c6386149104e42bbc211ab82dde1d6c868cbfa55df64e3c206a3e97f62c7984e1b27fd844794490d5891bd4e9c5045d593e72832aadf708d12e1f752f7741659886bfa335eeaea29289058b95f3c7e915f4e1e081e8d5f6dfe56903120d6c88095f1e588b048277ab44a9d134838b6af85980ffec0b8b420c578505eae2b58bcfc3680313f7d6e2250f3b2b076096ab4d453090bc55c74d8fb70ac6842b9094857678037e54c5bb367ca1908b2c05bc9e120fe97a20f1c0e096a4164254bc884fb8daa4e043ee1543abb375b3c6b381869fca4d6397bf5f80293863b46b900a30afe7d10b40f928473e3baf188b3c75a74b2ebd38479ac4133814f12228bd320c6e515a825bea1e4"], 0x0)

15:50:46 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x40}}, 0x0)
close(r1)

[ 1838.847633][T20191] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1838.872073][T20191] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
15:50:46 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
write$P9_RXATTRWALK(r0, &(0x7f0000000180)={0xf, 0x1f, 0x2, 0x8001}, 0xf)
r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x42, 0x0)
ioctl$SNDRV_PCM_IOCTL_STATUS64(r1, 0x80984120, &(0x7f0000000080))

[ 1838.894874][T20191] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
15:50:46 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r4, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
recvfrom(r0, &(0x7f00000001c0)=""/81, 0x51, 0x63, &(0x7f0000000240)=@ll={0x11, 0x11, r4, 0x1, 0x7}, 0x80)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f00000018c0)={0x4})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="4000000010003b0e7a0000000200000000000000da293d13d848b22bb50903b2d140b7bad3159f1a0a6ff35d0272da9b60e3ae1b2ff1a7c697b7da55dda1dcd2a41be931c2f81dd1e8f3ab8990fb3a0f64d19604f18bce15e85d5ba8d184cc4b4197852c8062859aef6a45e690d63ceccb49ba54b7b88c278305f42d00736faa68942e4b5e11bba02d9971360900cc60fe2f4c5e59b68c05865df1c02502e23f0e6745d9deb5b0dfa15fa758d4a44dbf0d6539613b60ae61d5b20330c89f62467a1ff15f68f0917000c67bb8cb4fe0fe000000000000c426ad84143ea2690221edb9e822bde1a3f5d7c66f31eb3f732e8ec8fab52ddb524a3bf032f6511538cb7281f9c7c035eebef606a582c705d950ce4e138fbbb7b528fa2c6e8238f3", @ANYRES32=0x0, @ANYRES64=r6, @ANYRES64, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1838.925085][T20191] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1838.954172][T20191] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1838.980726][T20191] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1838.999446][T20191] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1839.015693][T20191] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1839.028313][T20218] ubi0: background thread "ubi_bgt0d" started, PID 20218
[ 1839.028439][T20201] ubi0: detaching mtd0
15:50:46 executing program 2:
syz_emit_ethernet(0x1016, &(0x7f0000000180)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@llc={0x4, {@snap={0xaa, 0xab, '\'', "48290f", 0x6004, "eb5a1ed37945d3a7ef8a18eb58c0a4a40301bb019c4c01fa8626ba778e005c2c7bcf802d8ab8f5db6c50a4129c0fbc24941d4212ef6daaac6db1c1a2560fb9493ff49ceb9147b70ddc79ee12470b30b8bf3e835cd78180f3c6d60a4d3579005d2eb6e317298df58862c412a71a645348461c21f2db1ed054a07c44ba81465b6538654ea227329ed69e2812c87dca61d52735bf8d3477eea43eb39d2c112e9fb13374cda33e7bf90458b2952d08c3238d015dc67495d4b399bc6353d86c97e70b624aa66c5d268877b0c394424e44e249e1afec7446d7389ab0dc4b9b45478a05a6782e35637f1821777b4ee5527edabc1cf6b59a7a9156c45c030698b1041e0b670433f42a51227b8f1e183dbc7b7f1b42a5a6ff0130dea97741627858dd3c5be51c7d174c9b5706b12da39cedbc7a5602f6b266c0921ce22849d837b7fa1a87b0369aa47e2af821391bede294238fd9e292499415ede29316e5e6c2f4a05dba224db412dbbfedb198223ed0fb7d612b56aaec79d417e71b9a8448c8555df5ba2ab592531e64262b087aa874b471fede381eae8d610789e646ae27bf774c792fba3692c94eec33484f450956ca6f8c5b43e40f3ee52ca26933064462e17f7334c75dc86dc9e399989950f59b72b22daf16751480d13f1670213d91b322c4c34853682a7845748afa09286a0a3a85283c52fca0457dd14d3bb94fead9423869fe6228735cf9a80c9f118b678eebb3b6174c0201a72cb258243a2fa4365fb95a4dd5665bc2943a766de40790e3779ad6a54d5cbbf7f46be14f316830052679c4d7426c94f863d8962c42724c1cb559f1d06ff45eefa798722131dfa933215fe97a340165c2d9e894d21d2fd13e82994560bcdd4e515fddb974d85399ccd158aadcfad7d77632caf2536c3f97e4d812828ad76cc882c1c91094dcc91cff846eba3dd2d5093fd51814666035c06ecba704386d3d93694acfdff91f5a933ecfcacdbb1127fc39cbdab5052d46ae5fc735c7ba50e850a48c99373914de0b77e2ce17651465183cb26f15b49834050e7d839aeb7e13f55eef3318c9ada6547b39d9375cb01fa0dfc077d6a5ed4f7df39c66c66b5c289d0930ad41c9036564d425d3be1861f26f5fceb42909e8cf72f37b42033cfdc1daa29acdd427492fa2d52a019f7c1d7c921e760d8c58cb7f4e83840036e0cef8060e89ba9df32f480bfd20d46559d4a3e98840c9130240491d66aea07b2c20da0167f3b8910c137fa82a1cbff52b7c3af49aedb7e36aa27bef87894baeacd3ad3e98094fad1b9d45764edff29933c1721147acb9eb4ab0caabb12213489dd01b6a1e2cb8ab2b4c46f7b50f2862268622506f283880781c5d2a8ebc31f52465fea0d050b2f6508a760f03bcbdeff170e33b6e08b2c540b3bd53c0e8e0ac4f84c2f279433c555c62bff47c5af6b3552110dc444b237c680eb6fd1febc6357a41bf5e850c63e00aac32b25f72109a8dc8259666ecc945db1af900d6865282d58e7673409ee4254b467a8294b83e8b56a427391f1625c7dd50b33add5b533df279bec210efc34846a8b65890bceeff98094255ffb69659ae7e97d6f6b1d6ebb15cd64b163a99ee4e31e4807c2009ee50937c9d95a26a257613a3631fc4f26443883831e906ce0714d3d38115014d22f11867a5a2719f7cef8ee9612ca8d1c309271f62b8df1edb1c2959fdcc100c8e7c9e36de4307c18ac95a1d847a4f54891f04d574af4ce2ac59ccb62afbe7660df0fb3d74d39a4206628f225be7153f47c75e3865fd381847a10ad0bcd82ea31e7f258d02c79258a2b691232ebf245f2f2193b57a27132b1c9bc2a2f5cde9b88147a23df82960c1690e505a9179943acaeb7618c9220023035aba2571e3a59eb8973aa6b326afb499bd7f4c88ff185329096a9a8629522eee7484a52f74b692afed111a9d8287c668369525a9f5f783595cc1a64b85adf85f5d13e26cfcc970ee4da4cb3619cb63a2d71da3d8fbbf2445eb116d1e376376926fa6b6798e20646f82bf1a56a7f69327d29321560616372ef1e91f752f5c0e93ac3799e782000d2b98ac10a8a281f3211b6647c0ac6d8c39ae579f9dd2fc99cd9e490248a13944800659f9706166304d4fd5bb3db3469612e19d3ad67e22485ea3a706703adaaf72083a707f11b62363f76cb581dfeb7640ee9a8fac2e7f3e83eefc89d93de78786b544e324a35f94a339f9ec31b1fedfdce745420d49dc5611f4845f5d4d36832c3bceb287d1d5c563b7170ee65ac451ed3c5a2c20f7620511fc7c73c9e3f6cba84b1a46dfd14ccf96fd2b82c41b3aec0df0ad6f9fa9e668d0146847851c0692102181570d374ff2d47a5714b9f24f4c457cc4170bd5fef0afe9519f38913a4a7bea134b8d345c2a54e223e093d4e15d56e840812b466b3fd9cf89ecb212f415d037333e1f2cc5b6bc12440e909859ecbf876ff827e33c70415200e6c3e0b55bddcc2bf535403d2210e142ad210d939e87083e8be2762f6d45202256d13f0169872b4843dc471e9e37ec8d0932180c9eb899289c285f30923f8c50698292eb7af3de2479d3b4f00a08de0c8103289271a78a8ab89370850ced70ef24e818170ccfd825ba16a88ce3b8a116df47738d7e4b8b7334afbfea1c666d87d4e614fde3d013ca5cf4b24f05bba320ab32ed4325ed3c00946df3fc696a599f214fadd3bc33af2ea699006b4f76206ef9c01956d17e873a4a7a0d5a524c8ea0c8f85f9108e37f23773dba8997ad2e35d99f51e46354e5859974e0624b9fd98753554a67914b6802de04b20cd3756ef532e2aa954d7291de7ec4cc252513d0f4b00b590848396352a511f247df475ff6d8e18305fa47ee39492d98b6cf91b697bc3b4271022147229433d9095640d942785ce8762f5a714bbe733855b14a6f86748b3326373665aad03fa95351ada5d31015f01f24294b7ec24bcf4ebda951e055223c6d12770184fb19faa0d35cc22c2dd82fae2aee6d13fb3838f0ea8760a7861a2123ff8685fbf34566e34d13d22309b4d28b3ed16ba2778b74f1d3f4b72cf9e81a75c9db311f2437cd88a0a26446d0d34e8db0a379f23bef76567d43fa80cc47f79d820c4c39c21b4fd2be09649c8622bcb07f453dac436ea0c09b942aa1ffbd951d8daf6e2b646bc0aff948cb5b4b6e8f367482f9d8a288eb1adce8deb67a4ee83ca66ff3e9ebb614bef9a06ae5aea35aa54ec5fd7b5e7a10e2f6c898ff2f691ccd80e55a39c77d8ac20bb1b4972b901da0c8eb61c84ddb9e19e226c9c6f48b51fe46668eb06aeb39ee12c38e7d160de41fe5bea65dd2b37b1a95a4ad8c97f1cb4bfcf15440b30288f15e9febfe0262b5dbf41ab58c66714868e6f37e19fd6cd999355636b1ef4356d728d71469da9f26bfdb99af22235376f822da643ca69c9f4c7f1df6e4752b7b7ff9b1003830227a8b1c5466e9b295bdda751092882ee8eb5b5d89c93308e47b590f1f59dac840d475e80d7f80e882066c392c9139839b209f81920f99a1f6bea57b3fb4d5d4ec00ba0ac9af02995768291952e7edabf9414c6a23b09f71a2f33b91fd56d77793a5babb2daa3e63f811660b884033dd0d346388cde874b91904a88f24fe729e814e7f21656af4aea7e0d562e53808ec75f7aeeb31ed40cd00e8728f511cfca89e219e70d8450d7436105f02e2b83f886f162c5849114c6fc4fb5a61f49b866e1bf6c593ea2a9d6d4bb958831536a73a45d4b8fc3b3d4abf407a9fa8bf35f676e5e308f3a7a1f52428980722975d89f40dc65ef641447f61cda6c8a5c8ae745296bbc476ca9bb930447a39284b92565a6d8f8d031dd86102ac369036383cc0605e971649cb9cc46b41d566e06fc6e0f4e963d4fc6e0873c64e65537f0c509bed55265e71ec34862515e79299336caebeef62ca963be8d43a67df09cc7e99b7c0fa86f2f0e315ec8fe7f9717e8c7e221f6e3127c608666c5ab3cacf707025c65599beb3a8c67a2be359d9a03cbac6fd30339edb2e9091ce5f6e56da1d2d4084767cac6c31e4098fc8b81bc55a6d07964b91dbc70d63c130c389f50aff6dc867e2e31564f156c470c67fa6f123faf3cbf08ae877abed24f11bf70ec50937ad613857e59da35e048b265e595dc572852a82c7e32a6f82570ce05e17abcbb1157496d92cac1d9c9f1633dde73b6d535546661de2b7b5ca0b4ebcb936d9d8144a95b8104883a7b9aa3fd24a151c84b4523a2d3af7cc6c807c8c08c218fe3df4d9a17f1ba93f6dac902cc63d46882ee348f6378da2a67b68d1a9b2a195e0439a6b9cd0387b7e1ffc249b6af84255195e06c7a0ab55e37cb9171ed10a410890d8664662f4e4193546894fef601f03fc01aaa86175394045b7601b21a2ff55dff18f9bea30eea9a5de932b26c898702d051aec7db8c9178fe1847b32bcf3acc2b0457e2af04b97f5b7a22529d4ef01923fa1a57416479e32d9cb7e89cb283615226c914c3e0a0adc15e2d299fbcd70aa42409ad73006d0ce909ed28b0ed0e8afe16e2ec9a3665402b48fcc42f1bd1a8e83f09ee3ad0585f52fe80fda2e38492f09d9c3615de375a2e068799a7511b9ee0fbc84da8cc845bfe503697f4deabddbbaabc9201042eb740e75a1b4a1c93a959b7ecdae45799f80b12cf2f96c05eb51dc589b8df2521871172102ed2cdbbd2cd6f0c60960c67f9cf85e2748a089788e561e672637c29fae187e825fa671217857b95b30c6c8e1883eb94f9d54b49f104c9c97fe88d4ab2c793e8531093499884ca04d8b4dfb84e58eb3cd9206d164eec6bcdbe603aab9faa5ce13632b2e723841d364ed5b17129f5c24fcd8f3a36072b705f63f33caef64ac05aed7636c64f0dc209cc5eb1a389a6ee44141efd6ea9eebc6b617849c38b5d820678ba6d32a56b678b9bfa56b73b8c4e5525538fbbc8756ead282f911f7dbba9faf8f81205c4323d4ca4d4ad48e63c7d28371a83b1af09c71f4dcbf2a6ba3c47029c7d9abb02f61e42e91043bb26dcb1a56ffcb4c94ecaa0f15a7daf2973c20c860cfe1a8733ea623bfb86faa08e37c66debb2305b4d2766ba9d652e46d38463830725dbc0d2de1914ba11d042e1f2ba4864477a5ae1651f83976d905358d186a808de3dde2835843d425a12e5013fe22f026c6ea7733f4e8708607cc1b810a291dc6d45ceac2f58e5d873be7277212c39f1ea434be4b9e873659d2754c5828ab135cf8f7a0611c60676c78730fa6c4c82751d6b84b5680780bcdb495bf172d990a09d95f03efb9d7446ee09b2c1a395353247e5396db9b35a3a90b3c612b5ae90e26453a8efb28fb5fe9c99743d1a638297bb7b7367eb0b421095754b1a345996b7f3e19e55d31364925e390f8fc4296fb3898c25a929e8faed1f7583e67fc975c47bce5da18dc49f3c2ac60e7c6252fa28f072ad87c186a841c9be54ce84bf60053ccdcf4c38efb46369e97a3523bb0b87e5c1b98c7d9aab25ce408783c95cd59270eb23a49941fa67ff07986e7b90b63ed92cf2fbfdbf3d0c677ba9f683500101c0284164e24baf2d14c866813df3172bd4f4deb41e15db49449da953ff19422468fc5ad1605f9b8fc21b4fd8a11784868109807ecfeb35fef4124a089e54af930856f4198f6ce0358c9397a4dcafb2b11da3e4ec9ac95bd47199996d1e84db67f52f18bd7ae0023fec11ddbbd4f56c202caa5ac46011f3b92b4b8fcf0d755108ce71ca8129f4d7a0c2390ef1f8886db5a5529b7d123e74dcdc11b45d01ca921a20bc218110a574e533d6a10024d4e"}}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000080)={@in={{0x2, 0x4e24, @loopback}}, 0x0, 0x0, 0x1e, 0x0, "81ea10709e4d7b77be3b0b7b5e46dfbf6200d0fa50658e1bb39a3b53e3f887979fd1960ce79671777b06db984426effec11fa39d438e5d5839f3ad3f673cb0ab815fa8cfb606baeb1d768af22eb4846f"}, 0xd8)

15:50:46 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xf0, 0x188, 0x188, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000040), {[{{@uncond, 0x0, 0x90, 0xf0, 0x0, {}, [@common=@socket0={{0x20, 'socket\x00'}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x2, 0x3, 0x4, 0x1, 0x0, 0x6], 0x4, 0x4}, {0xffffffffffffffff, [0x6, 0x5, 0x5, 0x1, 0x2, 0x2], 0x4, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ip={@private=0xa010101, @remote, 0xffffff00, 0xff000000, 'team_slave_1\x00', 'rose0\x00', {}, {0xff}, 0x3c, 0x3, 0x4}, 0x0, 0x98, 0xd8, 0x0, {}, [@common=@icmp={{0x28, 'icmp\x00'}, {0xe, "6d03"}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x3ff, 0x1, 0x40, 0x9, 0x5, 0x1000, 0x7ff, 0x3]}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x358)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1839.147142][T20231] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1839.166478][T20201] ubi0: mtd0 is detached
[ 1839.183732][T20207] ubi0: attaching mtd0
[ 1839.188728][T20207] ubi0: scanning is finished
[ 1839.238614][T20234] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1839.289768][T20244] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1839.305565][T20234] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1839.330824][T20207] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1839.346880][T20207] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1839.379940][T20207] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1839.421158][T20207] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1839.442014][T20207] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1839.466971][T20207] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1839.478469][T20207] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1839.495052][T20253] x_tables: duplicate underflow at hook 2
[ 1839.509204][T20207] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1839.521594][T20248] ubi0: background thread "ubi_bgt0d" started, PID 20248
[ 1839.529363][T20252] ubi0: detaching mtd0
[ 1839.592352][T20252] ubi0: mtd0 is detached
[ 1839.673537][T20259] x_tables: duplicate underflow at hook 2
[ 1840.689956][T20274] ubi0: attaching mtd0
[ 1840.729049][T20274] ubi0: scanning is finished
[ 1840.940556][T20274] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1840.948317][T20274] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1840.968911][T20274] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1840.977892][T20274] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1840.993321][T20274] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1841.004524][T20274] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1841.017014][T20274] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1841.032095][T20274] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1841.049129][T20280] ubi0: background thread "ubi_bgt0d" started, PID 20280
[ 1841.060962][T20275] ubi0: detaching mtd0
[ 1841.083107][T20275] ubi0: mtd0 is detached
[ 1841.087917][T20276] ubi0: attaching mtd0
[ 1841.096940][T20276] ubi0: scanning is finished
[ 1841.413324][T20276] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:50:48 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e766601a01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000240)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:48 executing program 4:
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x2)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES64=0x0, @ANYBLOB, @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRESOCT=r3], 0x40}}, 0x0)
setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000140)=0x3, 0x4)
close(r2)

15:50:48 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
setsockopt$CAIFSO_LINK_SELECT(r0, 0x116, 0x7f, &(0x7f0000000000)=0xa5, 0x4)

15:50:48 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = gettid()
tkill(r1, 0x1004000000016)
ptrace$getregs(0xc, r1, 0x7, &(0x7f0000000240)=""/37)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:48 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7ffffffe}, 0x8006, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:48 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r1, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r1, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r4, 0xc0, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r5}, 0x70)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000540)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf200000000000000700000008de00003d0301000000000095000000000000006926000000000000bf67000000000000150600000fff07003506000002000000070600000ee60000bf050000000000000f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad43010000000000950000000000000005000000000000009500000000000000d05bd98c13cc170962b51735140ecd8c3c090c100a72248445f9fa98694f3a88519df1465870fbe7f8c01c982af9f45358e3d439c072c05961f932fde5a905e67bc08627d42de2a4d7936fa2f4d9c817c5f71e0f46c0b890022865a94531b0ec9aec627e77175846bfbcd7c3e23339be6da4d03de41cfb8277313a5798c7f19dde0ef085bde2ed2bb7277330b4d981ee32f81913c7a962a1975e498d6fdecf6fb3086de88ffe7f464c1e1a5953acdb3fa929e51bffed9b9dc694c9f7ea6cc09e1aeacf7619e53699d182719e2b20c57711d31609289beba1b1feb8c391aefbd117821dcd7cbbbf121f2df1106de67144d4ad24cac8eddee39bad50a0740514c931157444b0e64de3a63bf6ac59c192e2587900748454868996204607e5764b8fb3a90e83d45fe514e7d92d507d0edcde4f1bfff50647c290071f1d213874d25f6c09e90aa8862fae08c62b742c4600bb2a02904a6ee16eb742124260bb13fbf6b3f6d24b80b6535541ff42cc7ff5abed394fea339ac6354b97af7262fbf8a0796f5c89228206bcdd4cb1044ec5f0497b789f65b8429a8d3ecb8472c1b5b8d77a67a86fb50c17eabe41f4ea44fd4e0a55b8279f704ae937064af1338e812b638be704fe1b1a9f46f5248171b442223026bda0644e8113c9c64d5bb57fd9d242e071df552dd0614ee6a1d4088828b95310d9"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10, r5}, 0x78)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2b1f47ac93bfc0ba, 0x4, &(0x7f0000000180)=@raw=[@ldst={0x2, 0x0, 0x0, 0x5, 0x6, 0x4, 0xffffffffffffffff}, @func, @exit, @call={0x85, 0x0, 0x0, 0x66}], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0xa2, &(0x7f0000000200)=""/162, 0x40f00, 0x6, [], r1, 0x3, r2, 0x8, &(0x7f00000002c0)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000300)={0x4, 0x6, 0x1000, 0x914e}, 0x10, r5, r0}, 0x78)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000000c0)='/dev/ubi_ctrl\x00', r6}, 0x10)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000000)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:49 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0xe1, 0x0, @dev={0xac, 0x14, 0x14, 0x28}, @broadcast}, "03000000"}}}}, 0x0)

[ 1841.619680][T20296] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1841.716483][T20303] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
15:50:49 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b1eda26814d054568bb4b2ed2b1f13b8c29337935582bcc89aa40c752596e78e04dd54b9bc0efec73dfda090000000000000035dcb04aead3a3ad3c3d8e4e202bf4293a87422f2044063d8f4d0c12564a103c46e309887673", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:50:49 executing program 0:
r0 = gettid()
clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x2, 0x3, 0x310, 0x0, 0x0, 0x0, 0x0, 0x0, 0x278, 0x278, 0x278, 0x278, 0x278, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, 0xe8, 0x148, 0x0, {}, [@common=@unspec=@connmark={{0x30, 'connmark\x00'}}, @common=@unspec=@nfacct={{0x48, 'nfacct\x00'}, {'syz0\x00'}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote}}}, {{@uncond, 0x0, 0xc8, 0x130, 0x0, {}, [@common=@ah={{0x30, 'ah\x00'}}, @common=@unspec=@connlabel={{0x28, 'connlabel\x00'}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x370)
tkill(r0, 0x1004000000016)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:49 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x1, 0x1, {0x0, 0x35f}, 0x6, 0x103})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0xe, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000180)={0x517, 0xffff86a4, 0x1, 'queue1\x00', 0x3})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:49 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28}, 0x10)

[ 1841.943016][T20313] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1841.957795][T20314] xt_nfacct: accounting object `syz0' does not exists
15:50:49 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x12080, 0x0, 0x401}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = syz_open_procfs(0x0, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
openat$cgroup_subtree(r2, &(0x7f0000000240)='cgroup.subtree_control\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e)
r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/btrfs-control\x00', 0x2000, 0x0)
ioctl$vim2m_VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f00000001c0)={0x3, 0x1, 0x4, 0x2000, 0x9, {}, {0x1, 0x0, 0x20, 0x9, 0x6, 0x3, "dbb343af"}, 0x0, 0x4, @userptr=0xffffffffffffffff, 0x5, 0x0, r4})
r5 = openat2(r3, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x30100, 0x12c}, 0x18)
setsockopt$CAIFSO_REQ_PARAM(r5, 0x116, 0x80, &(0x7f00000000c0)="e21e7b50b369ebf723dec2bc6b48ae66284536a1591910b5797254ecdaf2da63", 0x20)
clock_gettime(0x0, &(0x7f0000000280)={<r6=>0x0, <r7=>0x0})
r8 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r8, 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000002c0)={0x7, 0x3, 0x4, 0x1, 0x7, {r6, r7/1000+10000}, {0x4, 0x2, 0x3f, 0x8, 0x2, 0x5, "9d1a97b0"}, 0xfffffad4, 0x4, @offset=0x4d6, 0x4, 0x0, r8})

[ 1841.986001][T20317] xt_nfacct: accounting object `syz0' does not exists
[ 1842.003175][T20322] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1842.173122][T20316] ubi0: attaching mtd0
[ 1842.268237][T20316] ubi0: scanning is finished
[ 1842.478136][T20316] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1842.487155][T20316] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1842.495609][T20316] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1842.505715][T20316] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1842.515159][T20316] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1842.526640][T20316] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1842.544769][T20316] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1842.575636][T20316] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1842.604021][T20337] ubi0: background thread "ubi_bgt0d" started, PID 20337
[ 1842.611435][T20329] ubi0: detaching mtd0
[ 1842.640781][T20329] ubi0: mtd0 is detached
[ 1842.852456][T20344] ubi0: attaching mtd0
[ 1842.857268][T20344] ubi0: scanning is finished
[ 1842.976815][T20344] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1842.992939][T20344] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1843.007506][T20344] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1843.025966][T20344] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1843.057168][T20344] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1843.066509][T20344] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1843.095021][T20344] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1843.118470][T20344] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1843.132484][T20351] ubi0: background thread "ubi_bgt0d" started, PID 20351
[ 1843.145939][T20343] ubi0: detaching mtd0
[ 1843.269289][T20343] ubi0: mtd0 is detached
[ 1843.282808][T20348] ubi0: attaching mtd0
[ 1843.288944][T20348] ubi0: scanning is finished
[ 1843.394426][T20348] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1843.409869][T20348] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1843.425148][T20348] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1843.434631][T20348] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1843.443541][T20348] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1843.454394][T20348] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1843.463831][T20348] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1843.476562][T20348] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
15:50:50 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x1, 0x1, {0x0, 0x35f}, 0x6, 0x103})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0xe, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000180)={0x517, 0xffff86a4, 0x1, 'queue1\x00', 0x3})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:50 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x80, 0x0)
r1 = socket$inet6(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000100)={'batadv0\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180)='batadv\x00')
sendmsg$BATADV_CMD_GET_MESH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)={0x24, r4, 0xf, 0x0, 0x0, {0x11}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}]}, 0x24}}, 0x0)
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r7, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r4, 0x8, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40021}, 0xc0)

[ 1843.489013][T20357] ubi0: background thread "ubi_bgt0d" started, PID 20357
15:50:50 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x4841)
close(r1)

[ 1843.555019][T20360] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1843.625969][T20360] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1843.822211][T20371] ubi: mtd0 is already attached to ubi0
15:50:52 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d00000000000000950000000034b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d8481cd937694724f60825bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec0900b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x39}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00000018c0)={0x4, <r1=>0xffffffffffffffff})
dup2(0xffffffffffffffff, r1)
setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f00000003c0)={0x100, {{0x2, 0x4e20, @private=0x9}}}, 0x88)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:52 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r4=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r4}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000040)={r4, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000040)={r4, 0x101}, &(0x7f0000000180)=0x8)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:52 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000a00816ef63e1bf244e9075938f5e4207e7a68b4a74ea8efd5cddc4c00bd1270d3b86dbbfd0f8e42839d9ee334ab25b56dcbf06dc7a0c8f1987caf714bd4bd334288a55616ef01f711c40d0fffbb0b26d8c7c92b6e2d54c89aca0bae53c635f85c81607e71b169669f3e6710dbd8ae18f80368248637f2205ce076fad2d7e6b743622bec2065c8a4fb37", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4080}, 0x0)
close(r1)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000140)={'bond_slave_1\x00', &(0x7f00000000c0)=@ethtool_sfeatures={0x3b, 0x8, [{0xff, 0x40}, {0x7ff, 0x80000000}, {0x4, 0x4}, {0x2, 0x8}, {0x200, 0x8}, {0x4, 0x3}, {0xb4, 0x4}, {0x9, 0x4}]}})
r6 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r6, 0x0, 0x0)
ioctl$KVM_S390_UCAS_MAP(r6, 0x4018ae50, &(0x7f0000000040)={0x0, 0xffffffffffffff5e, 0xa63})
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r8, 0x4010ae74, &(0x7f00000002c0)={0xe639, 0x3, 0x1})

15:50:52 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$BLKRESETZONE(r0, 0x40101283, &(0x7f00000001c0)={0xa97, 0x7fff})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz'}, 0x0, 0x0, 0xffffffffffffffff)
r4 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f0000000500)={'syz', 0x0}, &(0x7f0000000200)='_', 0xfffffffffffffd62, r3)
keyctl$update(0x2, r4, &(0x7f0000001080)="9b1ee7d565ef3658a69dfdc75a4640a59521e6b6a44d666d8c25830b08b1d82c3c07856f9c1bdc41637928ddf3e540bea593e262d47e506f35dd853190c031e45f58258f93c0bc689b11d183e3bbabdb9ae6bb604fe84054568b0f7953d8aff3cf6d949d5e39f8244e0a28211ca2cb6bd57809eba99ffeedb9d25d13965fae5e506b448cda939934579dfc603d3b3fca4dee1a2fad3a124b099a689b516d8b9fd7eacf7b7a7319aee146aacb7a078c05e6c61a80a53fa8f1bef26fb9157729accc056ad286c2cd63494e84da20e03a5ce884e03d9bfe17e2e273501368be10708f4c2ef156e41cd5f5820cd5b4c3f2a9e9d2181efdcad40a1038af22865279373ce13e0da287c3cc90b87ec266fc6bd30ad3a3bd865caf8575fecce474117a6f70f2ed5ac562985424d480648ad1934e662321e0336e57259f0a1511e92a8c27d03d8292f42f0706e99f40d36a830ee0bb52cb25b4f88554fd3b056bb7fcd5025459753fd20795b7c7e47e38304b7daeb425a4e7dca3ed7036a13e66d2e2d8cf1cbd6b273bb43592bb460e1d21bad0c4b3f1b2a71ed6d8e0bb9345a20f9483552bbea3ffd97d29a639c0dab8bb11bed35df84d33f0e60179dc04ae9a26093bf8805ac529cdd90a201c681b6ae98db81116a9a07257a8a53fb57879849ab75ffdf27e2cfb3d734a6e20e1afcbd562089c64a19d9437922c7eb21d1b9bd01093ab878cef40cd27dca07f7031242bfb4324b5118c34e43e028a1880dd4f066cebe3232c2dd84441a7b1d9b150561d53cf553da29b76b944834d794cc1beb570f15dcd7479f3d29126d3484d5cbb5a83b3e9d734be1a5cf125f73da790ab55b53fa9fea3283014ea512bf1fa0260b1f8a16a243b10198d387421dc4bf086ea0878b9b53a954002b8e451e95f7f314c13a07d63ff2040a68b236a6f41779edd539e301cd9814567db3e74f28c17295eba6f1e3be61ff3e719d17f3148392d906a048d41f295ab6de80a50840525cb3df175117089466ec9ccc7c3f27a7bb1ca98ec097d5a367b06f0dcfcddb1d9b7c0d982adeb0cadda354fbe5409887d00396101e087331c180750410ec55de895a35c167971a10c947f76199b92ef29479b55a810291fe312f7b2a14cd89c5bfe2f41c8d467036ac8d65c24892429c5b9152dc45ea16b94f25ad51a79d086217581a719da2fe59277bea79c370bf770e20dd3bbefcb154161a11fbdb6b0bb69f7a8c088497da160af8cc470c629bedf76712b67115c1196d67c258d99f65caf7a577d56deddd61ac8af5ade835cfe71685cd93a71bbe591146fae920d0ab015e121ec335982e8fe353dec303cb0f7f8cf2533bcc477b026f1fa7cd09963b08169790e19b9b3e5d9714f5b5841f2c26bf7ad15c192cedcb18223ff5e820901989d6b9a5d9ffb2f015551dfd198902254e84b432ead6c8e0b87585ff6f714e4413911f8345ed8d4670dfe09ca1e1274f70f9fde5496d437cbda6d8a973603ad5a13d55466beb9ca923bba9cf256c55221f5b58f3eba5294ffa73c21cb446bd3f59a1b1eca28003f00cb858754cd97eb21f2861453a0671f26609f9a471ba73d1c9cde51f87000574a269fa4a9d5368e0b706493a3ab76aa7aa5f0347549777a15fcca4181a5b3f8874f1b007307e5b71b65ea48db235256caed59d62d26d1b8bacbec0fc212a57900ee0594a6d0b49b5c6a96619531fdaa1913208e182237b257a9c7c69ee1ff88cab32a6e9eade553366b72f2c8cff34826dc2a33ad42a171f3b80a4e922491ee1c580e4769cec4819f75f009ca79787c7569319054c324a84bb2a3bb6269938b81f3a029df27404e12d1a4158675506e80d4f5095a4e23373f340014efc520", 0x531)
keyctl$revoke(0x3, r4)
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f00000003c0)={{0x3, 0x0, @descriptor="500823397fbf42c9"}, 0xe5, <r5=>r4, [], "9df17436d0a78ccc86f034ac4491a9afeed81ea3d6060f7776d4384db459c7850d6fd2b018866f607547af2c6978f53cced8186c0473a318a033b8d128a6b569dc16fb79f7391a26cde1b284fcd093ab1f1fe185863432a4e22f282388096f0c9d1af28f12ec5a1723b52ac8d3d7a620a95d4867e404c7db6141235a4d247c329b9125a867d1982db6dfae3997e338c5e92a086d7f11616bfedcc86fb5c6f16404b8b1d24d0a981c334d86244fbd0f8ef10a41340e42e52565b15c997cd245179066888f873be04070085b7f98872386e3ab792cfbd06809adecaa11a389e191aacc02795d"})
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000200)='trusted\x00', &(0x7f0000000240)=@keyring={'key_or_keyring:', r5})
ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r2, 0xc01064c7, &(0x7f00000000c0)={0x3, 0x0, &(0x7f0000000040)=[0x0, 0x0, <r6=>0x0]})
ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000180)={&(0x7f0000000000)=[0x2, 0x9, 0x7fffffff], 0x3, 0x800, r6})
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:52 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaa94e6465ebeb170aba2aaaaaaaa80c20000000004000000000000002000739078ac1e0001ffffffff0300000000"], 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYRES64], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32, @ANYBLOB="00000000ffffffff010000000900010068667363000087c47171a17a2ee25613140a9b9f803ad8be3a7d89cec95cbee6e77d851c976e6fbd05164f61847bf83516619aed2df1a774a306f5dc17d5242e92dd7f5e93302bc52de198bdc310290eec8f52ead3123e63942ff1ad151845980bafbb8f6fcf0f2e0b55"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="8800008cf2413a77002c00270d000000000000000000000000490048eba0dae829639d765c4cb97c8c670809bb711aa6498c25d52caaae5d2576237afc7e6692525bd15cb6a874f02b484b0bcd1538a8cc7020e9046a0fcae5ded17374fbeffd489d4a2aeee8533d55277b06e4d087d351959bb65711cebdff718138563aa98092e1b927f4c899002f414fb6342bb2c1a65bbd0cdd5fd4d0303948195b319e18739534eae0a52be1e7031e0d57994355a4598131aa45502464", @ANYRES32, @ANYBLOB="d05a0000000000050e0000000700d35d6ed5a4cd0593e92354ca1b01f16677"], 0x88}}, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4800000200000000000000f00d874f107548211c759e5d8d41b0f0eaaef11cf57875b70b5c621362f9d36d8f789a3753892ea94ff24e43e462df1785dcfe562dd7c50ce08a852acf1da2b1b93f81b8db355dc2edba7cbe5025c4ce0b26e7d87e45a10b51c38d80227633a3a4be088e23f6e39ea550c7df716a49c192f12a", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r2, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYRESOCT=r4, @ANYRES32=r4, @ANYRESHEX], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000002400ffffff9ed30b85db39bc353c3be339145333e27f0000f59ba40780c9e33a", @ANYRES16=r3, @ANYRES64], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x8000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r4, @ANYBLOB="54a124ffe5fc88bf05f7ff0000000000000e"], 0x88}, 0x1, 0x0, 0x0, 0x24000801}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000001a40)={'syztnl0\x00', &(0x7f00000019c0)={'syztnl2\x00', <r5=>r4, 0x2f, 0x40, 0xe1, 0x2, 0x4, @mcast1, @loopback, 0x1, 0x80, 0x80, 0x5}})
sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000001cc0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001c80)={&(0x7f0000001a80)={0x1f8, 0x0, 0x8, 0x70bd29, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x1f8}}, 0x4000)

15:50:52 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x1, 0x1, {0x0, 0x35f}, 0x6, 0x103})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0xe, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000180)={0x517, 0xffff86a4, 0x1, 'queue1\x00', 0x3})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1844.803058][T20385] ubi0: detaching mtd0
[ 1844.808914][T20387] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1844.866190][T20388] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1844.869753][T20385] ubi0: mtd0 is detached
[ 1844.910316][T20396] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1844.921810][T20390] ubi0: attaching mtd0
[ 1844.926845][T20390] ubi0: scanning is finished
[ 1845.019877][T20388] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
15:50:52 executing program 2:
syz_emit_ethernet(0x86, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x1d, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@timestamp_prespec={0x44, 0x34, 0x97, 0x3, 0x3, [{@dev={0xac, 0x14, 0x14, 0x2d}, 0xffffffff}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x1000}, {@rand_addr=0x64010102, 0x7}, {@multicast2, 0x81}, {@local, 0x7fff}, {@broadcast, 0x2}]}, @noop, @lsrr={0x83, 0xf, 0x20, [@multicast2, @private=0xa010101, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @generic={0xa, 0xc, "0b9aaf18e1cfc8a4a8ff"}, @lsrr={0x83, 0xb, 0xa9, [@multicast2, @loopback]}, @ra={0x94, 0x4, 0x1}]}}, "03000000"}}}}, 0x0)

[ 1845.091137][T20390] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1845.113371][T20390] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
15:50:52 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="40003b0e8aca67eb946a185076b08c4d", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100a7d6c95c36949fe1d64b7ae62dba00c53ca300a02ef9", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1845.141906][T20390] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1845.173446][T20390] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1845.200733][T20390] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1845.226453][T20390] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1845.280810][T20390] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
15:50:52 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000a0049c1601fcf3d3b65022643f6561e47559e", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1845.334782][T20390] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1845.378736][T20414] ubi0: background thread "ubi_bgt0d" started, PID 20414
[ 1845.386335][T20389] ubi0: detaching mtd0
[ 1845.404714][T20423] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1845.447977][T20425] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1845.486951][T20389] ubi0: mtd0 is detached
15:50:52 executing program 2:
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000017c0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000005300000001cfaaf2d0000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3019c13bd2321afb56fa54f26fb0b71d0e6adfefcf1d8f7faf75e0f226bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ceb9fbfbf9b0a4def23d410f6296b32a83438810720a159cda9036b4e369a9e152ddcc7b1b85f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6e20cb0cd2b6d357b8580218ce740068725837074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa00000058138d3d0000000000000000000000000000000000020000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f7da31cf41aabbdd343fbfff4583d06c91fd6b11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46362c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec309baed0495f06d058a73650d6fe048ba6866adebab53168770a71ad901ace383e41d277b10392a912ffaf6f658f3f9cd16286744f83a83f128f8f92ef992239eafce5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cefd4a2b94c07bd5d4aa10aed8477dfa8ceefb467f05c6977c78cdbf37704ec73755539280b064bda144910fe050038ec9e47de88298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06dddeb61799257ab55ff413c86ba9af34c270246c878d01160e6c07bf6cf8809c3a0d462357b22515567230ad1e1f4933545fe2c741374211663f6b63b1dd044dd0a2768e825972ea3b77641467c89fa0f82eff161c12ca389cbe4c51b3fa00675cc1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc20f49e298727340e87cdefb40e56e9cfad973347d54ff231a1b933d8f931ba3552b2c7c503f3d0e7ab0e958ad0700822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2af79b8d4c2bf0f7a2cb032dad13007b82e6044f643fc8cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd8cba16b64ebbbf8702ae51d93c8234991a225c120a3c950942e367f603e3856a346cf7f9fe0bc9f2a1a7506d35e5eb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814458a8125df532d87cb04c0174326d2c0002dc79bb7a51ccb589d075d2e5028fffddb88967c2eb6daf68537d7593372a3418e1edc418f22d1c66023f1d937d41553e1501cd55b91dc02097f3c94de004a3d49d7bdfdf3ec2a0b698a360832907a6ff63efde66226aef551262e1ff2be49db88f4d2718cef246eef210d62f3deb85bcc1e1d6ecc1c51b538d352e6c1d55a0266ad1d0d561d837d7c7757770000af5eda0e7cc256c95f784f4fdcd4789487660d723bbfee5ce97124836df0c80112b5168554091c6ad86628a3bdb96deda5513080178e1d19b8eb1b630e14672a7e1a057913495694d748714ab86714a9cbeadb3628c032006c8d239ec64f3b0862a503eb01a2d9909f57753615007e8c8d6bc817405adb102bf7d9892be4cda592a6229df644ebed41ad178cd269b028408905a044876d3600828495e4903f9e32c5c2657d082c1f17e40fbe6b046f2d3ef6bf2c72edcc922550117dd9d12a60a338842e093206081d6e3d7bfcd9fa977ebc27550768a91fc037ce040d9ac1f31e217f540155d6765ce0ad78cf910f7ed1c0dab92c517917616f80c227709b8dc6416de581baa8c3d8dcb84efc691edfb7ffbc865a24d8ded945aaf04c903948dcab755c106ccf1c40f17fc70d29bf5870d87f9361104702b94738b6b9e5d7ee158e8c1da9b8cad9"], &(0x7f0000000140)='GPL\x00'}, 0x48)
r0 = open(&(0x7f0000000240)='./file0\x00', 0x800, 0x40)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r0, 0xc0, &(0x7f0000000b00)={0x0, <r1=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0xfde1)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={r1}, 0xc)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={r2, 0xc0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=0x8001, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x2, 0x3}, 0x0, 0x0, &(0x7f0000000300)={0x3, 0x2, 0xff}, &(0x7f0000000340)=0x2, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=0x7}}, 0x10)
r3 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r3, 0x0, 0x0)
ioctl$TUNGETIFF(r3, 0x800454d2, &(0x7f0000000200))
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={r1}, 0xc)
r4 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
ioctl$RTC_RD_TIME(r4, 0x80247009, &(0x7f0000000100))
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r4, 0x0, 0x0)
r5 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, 0x0, 0x0)
ioctl$UI_SET_PROPBIT(r5, 0x4004556e, 0x1f)
ioctl$VFIO_SET_IOMMU(r4, 0x3b66, 0x4)
ioctl$SNDCTL_DSP_GETISPACE(0xffffffffffffffff, 0x8010500d, &(0x7f00000001c0))
syz_emit_ethernet(0x26, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2001000080045ffffff030000f4ffffff000000000000100000559db90422d3b40a9d989084e0fba28c1586761419f3dadab15b6d535249a38eab5e11c61e4fb5b91e1cd206bb5cf1c88a4a5b4a6d34b485d01d0eb37005647df43d11a8903eb09fa097d0a56ee37f9e729f3bf63482658d59b5f57af3abd181d9b478a800747a529a3eaa4418fb39a608cbae045d5a2c2b1768995be517e4f43592d7"], 0x0)

15:50:52 executing program 5:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x40, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000400), 0x8}}, 0x0, 0xf, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
r3 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r3, 0xffffffffffffffff, r2, 0x0)
r4 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
r5 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r5, 0xffffffffffffffff, r4, 0x0)
keyctl$instantiate_iov(0x14, r2, &(0x7f00000003c0)=[{&(0x7f0000000040)="e4077345415f1e8a171fe63a9b59a99b9f06e14e1e4a6eb890a9adbb89be3a74107398dd4412", 0x26}, {&(0x7f0000000180)="0cda77b1f0ef82a96ebd094a895a70b0bca86642659d6c8d913cc75a6208b93979a5136403c4e18050acfe4024f4c4c8134cbe9a9e4cfa24e25e8c1d7f2aa656c76f820b697f4f8351796ab0b4a4a8d32cb02df6b50b7b5aee08af4c5a1871bf18451f5fc302eb8ada522a03b155e90b7346159d2d71dea5ca5813b239e0951694155ce094", 0x85}, {&(0x7f0000000240)="6c23662d0ce49e39ad147fc185e459c9494e863ffe18237d03c5941e0720d9eaee5e2d3f69f7f6940da77bd7ebed8da147d84a3a482aa788ce7ea2d9b5e81f40ab03e95583ede7f27c9c359408ffdbdc92c88c0b6051c01f06ad6e9613a3cc5e5b1b2b76186198b3ef5e6f63b00db92c45bbffdb21fdf958dcf9917e7b50a017e5c97fce29a61c554f92d933f4c2467ffaafa7030808de2d35e77b372ad822e4c089712e32a9abcd11f34b7783e3092de1de80fcd706e5736631d6ec4794e03136d225d25868f43ea3fbe580de2fbbd956b38ba915", 0xd5}], 0x3, r5)
r6 = dup(r0)
ioctl$KDSIGACCEPT(r6, 0x4b4e, 0x1b)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1845.506997][T20397] ubi0: attaching mtd0
[ 1845.513477][T20397] ubi0: scanning is finished
15:50:52 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000040)='auxv\x00')
setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, &(0x7f00000001c0)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1845.652757][T20397] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1845.674027][T20399] ubi0: attaching mtd0
[ 1845.679044][T20399] ubi0: scanning is finished
15:50:53 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x20000, 0x0)
fsconfig$FSCONFIG_SET_PATH_EMPTY(0xffffffffffffffff, 0x4, &(0x7f0000000240)='^{(\'\\[(\x00', &(0x7f00000002c0)='./file0\x00', r1)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1845.826952][T20399] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1845.874818][T20409] ubi0: attaching mtd0
[ 1845.879804][T20409] ubi0: scanning is finished
[ 1846.023135][T20409] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1846.038882][T20391] ubi0: attaching mtd0
[ 1846.046821][T20391] ubi0: scanning is finished
15:50:53 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f00000018c0)={0x4, <r6=>0xffffffffffffffff})
dup2(r3, r6)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f00000018c0)={0x4})
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r11, 0xc00caee0, &(0x7f00000018c0)={0x4})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYRES32, @ANYRES32=r9, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRESDEC=r7, @ANYRESOCT, @ANYRES64=r5], 0x40}, 0x1, 0x0, 0x0, 0x40080}, 0x0)
close(r1)

[ 1846.169902][T20391] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1846.194141][T20412] ubi0: attaching mtd0
[ 1846.199196][T20412] ubi0: scanning is finished
[ 1846.318909][T20412] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1846.359743][T20462] ubi0: attaching mtd0
[ 1846.367704][T20462] ubi0: scanning is finished
15:50:53 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x7, 0x0, 0xff, 0x0, 0x0, 0x3c44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x5}, 0x208, 0x80000001, 0x0, 0x0, 0xe947}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fadvise64(0xffffffffffffffff, 0x40, 0x3, 0x4)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0xffffffff, 0xfffe, 0x200000, {0x0, 0x7fffffff}, 0x83, 0x20fb})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r3}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000040)={r3, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000040)={r3, 0x0, 0x9, [0x2, 0x8, 0x38, 0x2, 0x0, 0x5, 0x5f1, 0x8, 0xfff]}, &(0x7f00000000c0)=0x1a)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:53 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x1, 0x2a8843)
read$hidraw(r1, &(0x7f00000001c0)=""/99, 0x63)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYRESHEX=r2, @ANYRES32, @ANYBLOB="1800120008000100707070000cff0100000001009bebd4046221dcb70cfaaa7e65919bc238660f260dc3819dade02b1ec6f9ec2476b1e810e8f15ab934ce9e98c671a4f5bf68025ae0dd930c4f10eda965fa2660c110e74d831b9e0764d40408a2375853a5a226e1ed4216efe6f09058fc6b6599fdda1b68c54ad5297cda8363fd24742a7b72d02b545af648ffa2c17e98f43384ce1936c42a00228926dc1a6f99d4b62cf38928aff3d52d087a85e07fe136d9a7db06d3a6c1882d0000", @ANYRES32=r2], 0x40}}, 0x0)
close(r2)

[ 1846.701277][T20462] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1846.781268][T20462] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1846.809182][T20526] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1846.829209][T20462] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1846.838142][T20462] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1846.852293][T20528] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1846.872287][T20462] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
15:50:54 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f00000001c0)=@isdn={0x22, 0x6, 0x7, 0x2, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000040)="0c3631fb419b8669cc933651be13f52992ba", 0x12}, {&(0x7f0000000240)="6cd4e4c62538d67d4b789b8f9064428f433c34235f1aa5ece1e013211700d0bb1306ead94d9bd828a5da47f2e20ec0bbd36c581fd615c2b2fc5359c22cfae97423763119cda011af8bec7c0cd132989d04afb1165275d5cfc5274c1034dcdd5e8ae46d2c6be3a2c865428f239cf589937bdfbe9e1ea6f862712df69d77ba212e1453f4d8c0cfed5380ef126008895e6818896c79286333ada204733fe8f880238b2c27347a40fe01d597f9347c171893c8e037f3c2e18247aa2098", 0xbb}, {&(0x7f0000000300)="e05503fcbc929bebb04fbc948b8254d3db55f4a2f412d36a589b4c7b186dfb27999945053a12b763166c6c9e97a2286fcd198c3a22fd2019b0d17ceacaf8643c764577abf4d491598e40bc3f41a955f20397d1ca17fdfb169663f4217f2c6ea75a4bef2ff8811cc3d155c1650e7e51147b980683a0e8bd0147617048f0dbf65edf5d7c1d1f2d29724107769ae0f66d4d4f8c05ab83e4622ca79eee6820f9d27e9672b874b49da64dd00fd3e6feb39dfd6d2e65a0da3edebd6f44fcc83eddc1102790f5f1df7d852232b04c", 0xcb}, {&(0x7f0000000400)="ae3d6adaca4f1ac0f566c17320c479ef72d64bd8053d141a23cb81044d053ee4dc07b55e666a1c38d2beffe25a311fccc8f7db69b28be2a65e97073b6239c49772246c2feb96", 0x46}], 0x4, &(0x7f0000000480)=[{0x110, 0x1, 0x27c, "63cda0c360e038e75d2227157ea02658495dbcdc5484a0a7c3b6009e4396e325a458af131ad50f238dc5169a0eaf720718fc5ba90d8b63dc2b9ffc06f18965d9970c1f03761e47361dbe56cc40c3ceba5419a707640629985674435cff5c0ccca70f25895ae0088254260df19f7be4e5eab3637a3155fca02d9b8ea109bc61ea72a81c38aaf31689f8b05d140edaafec9713b84c39b2f0e70816b46db881354f7927dab6e6141f44ba21ec82ccfafc4e11b59347d42f04a531254098b18d50fc69e86107154c609cd04a210b734f87b754668ff89a472b9a1572c0b9653f42d397881b74876424ea55bbc2518b5749712a014c56fa796959d7"}, {0x40, 0x131, 0x6, "11f6f765c4a0df738b31d37103e5ac26461aa7380acd4e8dc39ebbde291b9adc3fce19310b771a186739325a"}, {0xc8, 0x119, 0xf82, "e70cf8c91fee5e8073d85be62c59ec6a76789fc29a60a418e5ef6685c908cc0b7dbd74d0a4c13b7fe411768b962fcac829d65bd7cad27bb96384371727d9b97c0cf2bbee943d49838d9138da8678e76ebfb39c9e1596b66658b75ffd09a76eb4d789a2fb18fe65592a2f06bf05d53737282218565c0f20b07fcce048181c7b3a28d44e4bc9e49c9e739025b739d4e1cb1408a503b58096a2c8b87e2bc33c54fbb460086e2d2a4db2702ee8cadf1d1275458ab983"}, {0x58, 0x3a, 0x94b, "e862a08579bc6e1dd19ea06440ed0be949c07a9fe742d06b02b4f99656b3d8be082490024dcf059f75e9865f829d9d385a3b66a437a982e4975ac077ff416ebdfeba3fa696fd"}, {0x70, 0x84, 0x9, "f77d20efcfdf8f278c2dd759d7a9f782cc2d648f8cde136689e8d141147767783c1d27a859b03b877adb43ab6afa589891537133aa1f3fd51526197d1ecac0dd458a7e1b9eb41d85077235d2e3d532540c32987b2db75dc015bb3b"}, {0xc0, 0x104, 0xfff, "e55dc0830220d9b0352ea21f47c52e03cfdfb559294aebf77f2a407c4c86a1ac7cfd04befcbc8dad31f3b7d7922d185b500c47ee12f8553540022029b01d1a5944ec2c2c9fd8c8e783b49999e4decf5bde82f7f8ae0bec1a88e11e2b49bf193a86016c553a6b861a0a9caa5b915822561a898ff1fa04591d9751bcb20f48730d71a2d40901c122aff728f6c301cc55c15b0dcdf9bad716d5f6903be87eaaba179fb5ddf471abfdc13951eee3"}, {0x50, 0x29, 0x6, "83d03d9c73666e5cda6bd60444c6fa5daf53a746554f321f74c9a2c1ac3608a1112eca28894383dfd8b9f4bc211ee39d0d2941511ee56447f7a088fc7f11"}, {0x80, 0x10f, 0x62e, "3dd22f0c338ccfee57ba2cb4234355750e331b5accf3546a98b2da366e9ee77fdbd27147be88357b0dbc7957d3ff891b3cb1a05d1152441389ab17d49bd4860f2795e9e92af6ba8f6b3227e8b5f352916c0e4482fbe7e898038079e1fcfb4b960656454478ef89b8fc"}], 0x470}, 0x880)

[ 1846.883169][T20462] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1846.943739][T20462] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1846.974149][T20462] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1846.996955][T20517] ubi0: background thread "ubi_bgt0d" started, PID 20517
[ 1847.005158][T20440] ubi0: detaching mtd0
[ 1847.015256][T20440] ubi0: mtd0 is detached
[ 1847.040134][T20469] ubi0: attaching mtd0
[ 1847.044972][T20469] ubi0: scanning is finished
[ 1847.297997][T20469] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:50:54 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x1, 0x1, {0x0, 0x35f}, 0x6, 0x103})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0xe, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000180)={0x517, 0xffff86a4, 0x1, 'queue1\x00', 0x3})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:54 executing program 2:
syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[@ANYBLOB="ffffffffffff0180c20000000800450000180000000000739078ac1e0001ffffdfff0300cc24cc23bd1ef017749d6af2a81a2c8dbfbec89d889cc45c71fa05229df6c9af279e3ff0101b6af111289e71a65b2f55"], 0x0)
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x290000, 0x0)
setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x7)
socket$nl_audit(0x10, 0x3, 0x9)

15:50:54 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
mlockall(0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:54 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
getsockname$ax25(r1, &(0x7f0000000000)={{}, [@bcast, @remote, @null, @bcast, @bcast, @rose, @rose]}, &(0x7f00000000c0)=0x48)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
write$char_usb(r2, &(0x7f0000000180)="165b59cd8ce6acad28f6d89f897a369358b54ba409321d8e3a8ec3fba7f86d11db740244c8565887ded788567eed31aa2326ac59a1b78bd95ffc85de9540be1f8dac9a8866f5260867cc430e34c5877171b920b9da6b67dd559eac1f38f122c136bc7376f0daec1b2af4a581b0df1454090607fb30856654bc611a01482f138495b79c1834c6f96cfcec273a0c8f905d9c90757eb20ee9e7176e08661945c97ff5b37f47a14bcb227d2c2c0306320384966087285c264304cd992d144bde2c73449acd8fa0b272b942f92d6fd84268d616b2cc8d7aac3a353ddf8ce0", 0xdc)

15:50:54 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="120100003ab3f110401c3405ce63080003010902120001000000000904"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io$hid(r2, 0x0, 0x0)
syz_usb_control_io(r2, 0x0, &(0x7f0000000800)={0x84, &(0x7f00000001c0)=ANY=[@ANYBLOB="000004000000a81ee05a4f4d8762dc938a5d8013d2a911a0498e8704d7b4"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r2, &(0x7f00000000c0)={0x14, &(0x7f0000000640)={0x20, 0x21, 0xd6, {0xd6, 0x10, "0373d58e21866c709c6ef2c2ab79753c9efb307a65f0c016fbb310ac0275d6062cfbeadaec2a8d748980f2fc177edb5f02531119c5b73290e8698fbc7fad03cf9f0890dcd523be110bb5c97d3a5d9053f8ebc7557650e6acf8520bb2694bf76a1a674d49c71d52c72058b1bad1daa00fa4b1889698adb30373130732820ba11a4ff2664bd87a28f49fa3a33891412d03eb3f1127f97b77500ad741954f03b1a10560c557a4cb2e9063d2b494097e5bf2af47a4516c3c1ef826f579b59e19b340ac4bccf15b81355d64bb07b024b42b13afe5772c"}}, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000004c0)={0x44, &(0x7f00000002c0)=ANY=[@ANYBLOB="0015ed7a5d160445e68f541962423f26ed54460000005044387ef55ae10200ba9b170726964b722fdab8fd383bd29edc01c3dd4d7a537dab4bdd194778c16e1723568cc3dfd80afd9a20c9ae"], &(0x7f0000000140)={0x0, 0xa, 0x1, 0x80}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000380)={0x20, 0x80, 0x1c, {0x40, 0xfff, 0xffffffff, 0x3ab, 0x6, 0xe76, 0x2, 0x0, 0x3ff, 0x100, 0xdf01, 0x6}}, &(0x7f00000003c0)={0x20, 0x85, 0x4, 0x9}, &(0x7f0000000400)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000440)={0x20, 0x87, 0x2, 0xb}, &(0x7f0000000480)={0x20, 0x89, 0x2}})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:50:54 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="340000000000000000000000070900020073797a300000000008000340000000040900010073797a3000"/52], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1847.563429][T20550] ubi0: attaching mtd0
[ 1847.594878][T20550] ubi0: scanning is finished
15:50:54 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x3)

15:50:55 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:55 executing program 2:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$VIDIOC_DBG_G_CHIP_INFO(r0, 0xc0c85666, &(0x7f0000000080)={{0x0, @addr=0x5}, "143056109e1701ff92a934edc1260a5cb400e4e7e040a2bccd9a53ba233bfba2", 0x1})
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$VT_ACTIVATE(r1, 0x5606, 0xde)
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

[ 1847.800948][T20550] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1847.820168][ T2480] usb 5-1: new high-speed USB device number 17 using dummy_hcd
[ 1847.839351][T20550] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1847.874315][T20550] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1847.898234][T20550] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1847.917964][T20550] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1847.934738][T20550] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1847.958972][T20550] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1847.983797][T20550] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1848.009500][T20568] ubi0: background thread "ubi_bgt0d" started, PID 20568
[ 1848.020294][T20552] ubi0: detaching mtd0
[ 1848.073795][ T2480] usb 5-1: Using ep0 maxpacket: 16
[ 1848.090820][T20552] ubi0: mtd0 is detached
[ 1848.109075][T20559] ubi0: attaching mtd0
[ 1848.115226][T20559] ubi0: scanning is finished
[ 1848.228540][T20559] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1848.256284][T20559] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1848.289706][T20559] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1848.307449][T20559] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1848.311036][ T2480] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=63.ce
[ 1848.335568][T20559] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1848.346674][ T2480] usb 5-1: New USB device strings: Mfr=8, Product=0, SerialNumber=3
[ 1848.351486][T20559] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1848.385746][ T2480] usb 5-1: Manufacturer: syz
[ 1848.409557][ T2480] usb 5-1: SerialNumber: syz
[ 1848.418414][T20559] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1848.441323][T20559] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1848.462848][ T2480] usb 5-1: config 0 descriptor??
[ 1848.490282][T20580] ubi0: background thread "ubi_bgt0d" started, PID 20580
[ 1848.490292][T20558] ubi: mtd0 is already attached to ubi0
[ 1848.490643][T20562] ubi0: detaching mtd0
[ 1848.524970][T20562] ubi0: mtd0 is detached
[ 1848.545185][T20573] ubi0: attaching mtd0
[ 1848.551397][T20573] ubi0: scanning is finished
[ 1848.554800][ T2480] i2c-tiny-usb 5-1:0.0: version 63.ce found at bus 005 address 017
[ 1848.658501][T20573] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1848.677076][T20573] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1848.736913][T20573] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1848.746182][T20573] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1848.791738][T20573] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1848.798849][T20573] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1848.808368][T20573] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1848.819226][T20573] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1848.830452][T20589] ubi0: background thread "ubi_bgt0d" started, PID 20589
[ 1848.830461][T20572] ubi0: detaching mtd0
[ 1848.864395][T20572] ubi0: mtd0 is detached
15:50:56 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000140)=ANY=[@ANYBLOB="aab3aaaaaaaa0180ca00004008004500738230563a6f20efb1f9d50018000000000000000000614644616a07c1d9742778e8d5e472e08fd536d27b13720dfe2169b8c43d3ea43a11cff844cd066b22ba532c70b04317602a64ca8816c22000dc80e0b27968060ff2aa10fce5c007655e6abb805650841e17bee9c60d5858f501860addb71096145517d1b758c3991a28ba2e87e751fbb8bf01dfbbc7274de77d9735a619b1286ea9432aa4a983bf37de224d08edf2b13c28ed03b87e90e4b7a7c2eafc43afcddde2dae1c37348109e29189b3ff1a7ca065aa74626c6b77671220cbaa069ec"], 0x0)

15:50:56 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0xffffffffffffffff)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:56 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
tkill(0x0, 0x1004000000016)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1848.990346][ T2480]  (null): failure reading functionality
[ 1849.032036][ T2480] i2c i2c-0: connected i2c-tiny-usb device
[ 1849.154551][T20608] ubi0: attaching mtd0
[ 1849.159797][T20608] ubi0: scanning is finished
[ 1849.335645][T20608] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1849.343942][T20608] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1849.354574][T20608] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1849.362344][T20608] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1849.371689][T20608] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1849.393775][T20608] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1849.420830][T20608] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1849.445676][T20608] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1849.468961][T20613] ubi0: background thread "ubi_bgt0d" started, PID 20613
[ 1849.468991][T20597] ubi: mtd0 is already attached to ubi0
15:50:57 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="340000000000000000000000070900020073797a300000000008000340000000040900010073797a3000"/52], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:57 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x9}, 0x0, 0x0, 0xfb, 0x0, 0x3, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x400, 0x0)
sendmsg$kcm(r1, &(0x7f0000001400)={&(0x7f0000000180)=@ax25={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1}, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @null, @default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x80, &(0x7f00000013c0)=[{&(0x7f00000003c0)="2860a3f62a3f55341b40f9b0564c48b2b4d41c640f862c97ac3f6d6e04d91a7075795f0942c9315c3f84734aa21f526216abb39538175fb7df2f4203f05df53d8b96c0f5252eafb086dfd2e66a4aa5d6e8549f78499af958a19f1f58e204771b09c570e409c1b315d22e769888f9304719d7593f689ad7364a94de7c2bd0578f6a8cb070f19c1db095678aa7ad009918aea8e746156b002bc5fe1a5d0eaa579d019d4e87cdb9b680f88bfc5b30534eb795f6c5cc656b4086289370343688f5974477d9a4539311efe52f95c3bd2ef6b36cd9de82ef7ace196d981c56d9ea8efe7c92759e11b49499ec7671dffb7e3c7d30813daf72e3f019c787785ec461848a8a78d4c555391caa7d702eece534df70a74a9d52526f0ad72aa9a94cef1832a73f4c8e38d1d613f39661f8dbc21b0f8549fd8fcdaebc7792e16757f8031049858a5a643368d7a2775f4e461443e4a6f1470da2fcfeb94dbd4b336f8aaddf23178de44c2bf140f44a1731e6a52730d19416ea22922a6d1cf153ec8f620ecbef2f6e6b499ccd127526abbb203f87dee5b65428c4a436b23447e22656205ed20624f4510efab7fffc3086e5d2c2cfe6c117389a229bb54a5ce5bf3e7821ecddab8b8bfcfb3742c2dfad645037773abd079954efe7ff40b1f43ef7b420b5d01e8052833b2bf5fc7346b167946fa3b1d45751151f1fb1ec57e9a41f0eb76ab7d8dd1fcff38d3bf32b5b63bfb2affcedc3987d33021ff3195218fedb5d8970053d3d0bda27309ee5ac987c5e3be41d7c1b327b2adbd592da7a7422f6eafca2fae194951ebd564202eb82101307042aeac02a728ce854c078205766cd8d3679f0aea8ce51ea03cc3b54ee68fe44e3c6d6f692d8eba9495bb21dd7a089859feb7e42a0460e75f3645b5bc95b75c7363281612d05da210181b32cc95455eebf109c7c1b714c141de9d2e663ba26b40cc16a03a9ef7994c95795b0579ed0a53eb4c74602cbdda97f2b5c68602f1336d6011a1d25c463e43c64d119f92a4243cd6348914c72260460d99c5d6289a6815ccdb569362ffa6a824060fc9f0bb081f27e4d087258ee63a6ec6aa3d8e22f1c69e8bd0590731694bff3a734b284f72fe7e584e25bdcf50da673872a41fe2d7121469ffcf0a9e4b9a91f19b3c606157b91bd080a1aaf0d9f79e7466f13609868c9f820365fc4165c6cc925f2054a978c65c88b6e4bb4eb61aea9fa94cad5d7fb7a1baed01f4f19ef3d563c462c1811a791d3df099dd12479e11a32c5106d02816061068ec7e9449e43a121d3eeabc2cdbf3a42cbe7b8603e55695956a329a39b0303f4436d637eef101ca320a3aeed963ebaa08e1a36d4c5bfbb9889fa6fcfb64a66e598db18b5ff3baa987959b41ba298e5cc0a4c9330ac800976473fa5e5628254412d48a19aeaa8968bd0a545affda2bba0bc8e2b8109653a405d2d25f08244c1640f20abf310ff5c37c7889720a73d56c669911b6f11cc01b687e117d52fa721a38c7bafcbdd0de7247b6938b24d26f165204e74e510aea5935f652d9b841f43925f5b2fce2d51653e3013336e50d281d0fe562eb7a49860f58156c4fd4788528c24ec7fb70b54c7fc1392a633606c8058ecdcfa76498d2303d5c38a53f6c50def1285c7adfa0cbc94a6e70758fe235b439a23e6a79be0458da3e302b3c7f7a9fb6c3d73a0b4ffcd89b1bc71b6d915f4b19c12bf4d82bb4c719188a1f2d15c15b0326606e01d2171d86f2a83f46ea1c9a885dfe98ea864970562d4cf7b52d41947f90f26b5312e3436409c9594a4721fd05d9e95b5b8d47b7cef8bcbf9bcbe0dbf49ab07bf4b61faea97fbfdcb2f370b0866dbfe54733b5cc598f79bcdf7a95773eb2df4ffac759e1bafb1245aa292efb3f0fea2b42bb6a945870410ba0f1bdc5b9c4f49df68510fa2326b16af8e036d4c05b849937519bc081612424fd839908760716cc377973f95a7054ef4e42d0d35e700e18c5d7edbf23d12c01754a70c7c4995c1b32068a7d6cadbd806e5b4cd1809c1936726e1522ba807806f22f64491a35f3a431364053893ee7b8e198f8317472129d44e5efa625486936d31f5c4c4d1ec2bae8ad9f7939daa9a4984a43c1f4e048b80c2385337e8dd2c0555d0a858706f2387d14a856af40d969c3b8c17e52eb26f650b9b878bda693f3198a766623ec01d84c6d4789b1f9d796238775f9bda7f80cd7e06f984e507cab415951ca4e37f91fe8f1dd4d51f4c123e65dd7561bf7f5ea080b6ece55b559686ddf6d31cfb91988c5dc1427aeaccb40d5ccabb98e9c7d05244a2916cd0585b98f44f677d6db0ac5a92d2518490ad32ea8c2efff9187ce17d8f794dc776beda7d9c06d099b197ccbe9a44a3575b76c50e3e460d2ccbbe7ad162c6fc063cf8765d2629472c743890c0b98c20833edb76d141a4c742e7d117dedb745a868f57ebc2176c1ca704c6d83429165a0ef5fabaf4dab14db0a1cb62743cadddcd5628fd910e92934ea416b1868c7ecdfa1ff0362b28b014427b5617be6717d8294ef6c15d94e5878423a2532465d82438474c2018468c590375fe0d9f3f13460a24c1904abf4e289102e0609deef0de69af69fc3956df3da284cc0d3a63272336a9eec864137f246f71e6348fceb5ec2c81f0ea3bf8fcc731ba90465061d83e3106b6c671cb69890543f1861bb43f8c2968ce238acfff58ce586b041f96ee97e97b2c7b2993e3a2eb270c7c8df32e94fd789b197d0f8bb9c097534cf775448a2b5c6b30d42a1aa1a97b149de22371682e7253a8046093754ce5becc05da75953695812a4e0ad12b28b354958e761b09028cdd4cd0ef24a104a7e55336b205089720b5120f9ce62e9745627f82dde484a7a82e2ee345dcab9c10377ed867dfa976029f5f58216d42b7a2b6992b236d4f6b17c984daed17fdcea54c76a282603b79bfdbba510d0b512aefa0ad987937a6e3b4bf0b14eefb6d76968d6122d64228c747db6e5209fe37ad12a753de85e9911744408b03f12a645321e14c3f2a5540c796c02182e35f5f06f1d8140d25da745dce7f18fee82a056385c4be0521aec4723032823920eca43b4de96a943c6ac4b6368e6ae1070945626a85adfc43e013f0530f21f673e3a8b55230e0a9b9b7be74f711788d9ee5b38b714c67e284b4de3886ceeb9c54c810e2fd91195ed72bf926e4c76bb77d0aca44a495d22507c4e280c0675ae8d6c0be539b74a4ed7b555c640ee5c45155a913f955c034e149d9ebc1a01f8b540c8d0920d5a0f737648862e8517870a1fce9af2a89b995759f7df4dfc3028c9c460abe01957d809fb8dd6e307479d094035bbbf2f65215ea465704fd0bb2501aa6814a128d4813eda0a33c47b77d0797031d41b3042966bbf55d12e00e069e1fe878ae87f57405b1184f8e8813b6d9680e3c63d404ff7754206be5991f5ec9d74c10bc0744e562adf6001773db2d6bd9185d8e28085b24cdbb60a16da5fef37d602b78b7489f157bb2300d94e03d4b1af23b14624599814282f7e9c52bbe8244f728ebf77df8681b2111dd4606aa59bb9bad96694e02b0af4d6f15745260f1ff9b1ff5f1512022c6539cc25b1bdae46a74908155a7e76b19310580b9d03eb9ee6cf7538e0ef3a35753b1085d144824ece881daeedea1a6d1adfabef7697cc77b722811637e1e470c90a87f80bc10d27bc0e80e66e6e8b432a4c0748fe687886c7b31f3015575d5f2cecbfead2b3a9595f6511e5a490c207bcd4a193ee617d6280445d5e36a9e54892845c929a992e08c37e54754d46b17871253c84d64cd07e7735f675374b198f18bc74f9a582a73b7d3ba875295a50738f01ec85f4f4a7f75d8500ba0d05c39a9b64d77e6ad3002e4a8c57e9a9895df40d1f3f7a35502bf2e7a5241063b5aa6a61df655b74443bc6b6ffc8c70bb3cfe89c9e6840e7989e379a840e8e453b896ed1a11254b03bd41f808e0826077fe1d66a6678c156a3cd0584e1c45d386879125d0f07a78ca49cc58d41f82c4db75d5280c32ea8f2b00e479b4f964d77ff8007dfda620a3bfd53444853d6cb5f850444fd0732940e717f9a93c7e3caada8ad52f8801258374aad8de168e2b49c18a571eccb98c9ecdb78fa123ff72f4fa414385032f326bb757b8d212b4705e9cff13f3071d248c2c352f2796f5e6dcd2540bcf6580843dc734610a422e525ea5899bde4890c45b4da8451a391ecc159ba893a8dc2c667fdc56e2829219040fca36172f06c92d85ec4c50ea5d574d740f9d47f88f5f7c0a592f6ace6bdd264605b2aec712038f75160e1b097c2b04d0551deaf48ae159603be563fbd63669f13f7786514dbc7fca4af63ba2248197caff8c79cf97b3fc6d52b557c393637f8b6d07ca131db9b5a5364c8dc381bf1600bc4391f73ae978f13984bc80264b62b3d92fa74eed131b7203b1d4cf647a2fbdd61b1698ec92ce441bcb826d39bdd4e39246a3073409baf5c22e9845d5691d393c65e1aad0d517a1e7f2a37723fded5096a013f17fc2279be87ed22afb2318ee7de40ba49c879de19dffb1ef0fa45ccdc58687b090da106ac450a1dd3c3530a8d37b7c6aa9473eef95e23e3b6c58781621bc2460f2f56b4c97b27fe7c767fd6eae1ec04075cff2d718cdd887d0a5ab21e02625594c58ade1d86116de2ed2309af89da43a8e629de79f8ac6efc4047e99765c55da135241a8abba5a3b4ce1d7394d79203c9fc4a22cfb4cdae368a31b2f60dfcc4bc38e57517012e4d115d569bae613aee7097271fae9f3b8fcc00d2fd23cbbcd5bddbef8f27b1cfd64c00f2fb66c6f1cc15f125f1f3045a9ddafe6daa6bcf382bdff79a83981eb24d0897f915a6a236c74f7ae81853e8e876c65582ef8ae128deddcbb6442a1cb6b587088d46c48961e11989f65e7701cc3586868d9103fc134dc17c5c885f996a8ee6e4b4f37589bb50fb2b55d85149d2eb76b677ef2322b99492436e60ba72584613bde4c735765412790246123a44f85919c37c69a6dc212c85d9a5c1f0d48f46e7db7827d75ecf58adad09575163a6c590d8031d624937cedcb52bdea90e4a4000d901919420905310679d21dff8d3ced5550f1a17065a92705cc4a8f794c37383ab5172bcda7d75cab4099b181dae04faf3c1b6f6d95dbc0ea99e7880904fd3428c5de84ef26af573d371e33d7de18d49b29016f2df2c1697ededda9156be7cd5e47b1da3336c31971fbe7fbefd8afb733080bfe623436892ead54b8d2cc52082b7c58eb3b4009c7d755ac9ec75e4b92a3d33bad9cf0e40b24b412699845eb28d29726af2c565a216fe60ae3507b03e2ab432fe17dfca2ea186daa1fb3ace2032188a1bb5713d5691e3bd7cdfd4b9ca85e282fe3146b56c1e9b7c04aa1777a81b5b426437e7966af4ffb7cf91fbf380413da854703fd9c8664ea3a5ac5b717a88f3d290551a1fe2534094253cdce20105886a63bd5666af72772c669d07e75045552bea0c031a61ef7f8a3635d51d307dde5d7f751f30023b55821711298b90e22e0d6130c11cf692388818712cff4c138a75f54e14400c3aa7ee0caee321a64b672634ee84e2f602e210bd8f5ef4f50717a7711b9ff8187a8c84d570dd3aac58c9dc2f212101c40fca0a73dac8ac813155b4e94a6089be786cf4728bac5c20ba2d389a71db8b2441e83d343ae41229b0fad3ee2a3ae13599a17208cce744c8c623d9e9904ea7199999af2e9ad3b19475b4f8150cde401b124837e799869a30d3033957879327cee614f9e316765cfe2e98ec56605b355", 0x1000}, {&(0x7f00000000c0)}, {&(0x7f0000000200)="c7ada6506211dde2b90c4f3bc16f4ef7f36f83100d2f5b30ebea225b1a14ea7852305befa5f9fea0178dfa1c89956bb95610113c1bec2c62d3f903b85418b1ab51c051bf5f634de3477ddbf34bcd37ac7ff1c68f53b6fba789fe9abce073116cb7cf025252c1a15ee776073d7d9bdf572b1f6fb5a714d3b39275352d79b084252d288a0588a544b9905b2cc74279ce31", 0x90}, {&(0x7f00000002c0)="01a80c2f87edd107dae428b041aabef1d8f4e03dbb5660d91ea5031f06d3995e35a342b799df223023fb2de8ae960f80e3c187711867c8855581130f657e2c80956e3c00ce3b749f46ed53c4b5004345c3b33bbd90d6acd906", 0x59}], 0x4}, 0x20008042)
syz_open_dev$ttys(0xc, 0x2, 0x1)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:57 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r1, 0x8983, &(0x7f0000000000)={0x1, 'veth0_to_batadv\x00', {}, 0x2})

15:50:57 executing program 5:
fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f0000000200)='trusted.overlay.origin\x00', &(0x7f0000000240)='y\x00', 0x2, 0x1)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0x650080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffc}}, 0x0, 0xffffffffffffffff, r0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000000, 0x4000010, r2, 0x57429000)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1850.203719][T20641] ubi0: detaching mtd0
[ 1850.243087][T20641] ubi0: mtd0 is detached
[ 1850.634953][T20651] ubi0: attaching mtd0
[ 1850.639950][T20651] ubi0: scanning is finished
15:50:58 executing program 2:
syz_emit_ethernet(0x145, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0xc, 0x4, 0x1, 0x9, 0x137, 0x64, 0x0, 0x8, 0x11, 0x0, @broadcast, @private=0xa010101, {[@cipso={0x86, 0x1c, 0xffffffffffffffff, [{0x7, 0xd, "a24b7f22513a246eec910f"}, {0x7, 0x5, "743d1a"}, {0x7, 0x4, "59b8"}]}]}}, {0x4e22, 0x4e22, 0x107, 0x0, @gue={{0x2, 0x0, 0x3}, "c5fa20200f3c39c7f1fb949206619983891b1f8544a0f0ada4d680d947bcb7bfd8cb133ea968fdfd16d290bf685e566f13d8e544fb14c14de53661be12d9d9022caac75b3f72883c48037a6a3c7e1ba340d6df52f6bb762eae6158a0d02b7a8d6759636d8c6f0f85ada9868a2c9c0c263407447d5f91d825e86cf0a165abf436788d62585df2c538a15c435ba020eb2e8c6d9b861b2570e157a73fffa6c2a8585a49d4b358953d05c57388303e8fcb64dcfeb17fe02c2200ccb50fc1932ac1dc184ca419aba64be1b9a8eb500fb6d4aadbc65821cde43fb1ba72d25f0ce8c3613fb79599392c0a79c40c0da05f472b47376cfd770b7207"}}}}}}, 0x0)
prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000280))
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r3}, &(0x7f0000000080)=0x18)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f00000018c0)={0x4, <r6=>0xffffffffffffffff})
dup2(0xffffffffffffffff, r6)
r7 = gettid()
tkill(r7, 0x1004000000016)
fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000300)={0x0, 0x0, 0x401, 0x6, r7})
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000040)={r3, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000000)={<r8=>r3, 0x8000}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000200)=@assoc_id=r8, &(0x7f0000000240)=0x4)
prctl$PR_GET_ENDIAN(0x13, &(0x7f00000002c0))

15:50:58 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
accept$ax25(r1, &(0x7f00000002c0)={{0x3, @default}, [@bcast, @netrom, @netrom, @rose, @netrom, @default, @default, @null]}, &(0x7f0000000240)=0x48)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x1b, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:50:58 executing program 0:
ioctl$KVM_S390_UCAS_MAP(0xffffffffffffffff, 0x4018ae50, &(0x7f0000000040)={0xb190, 0x400003})
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000))
syz_open_procfs(0x0, 0x0)
r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x40, 0x0)
getsockopt$packet_int(r5, 0x107, 0x8, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:50:58 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x0, [], 0x0, 0x1f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32, @ANYBLOB="ff0000000209000100686673630000000008000200000000000004"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, <r4=>0x0}, &(0x7f0000000280)=0x5)
setuid(r4)
setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000180)={{{@in6=@mcast1, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4e21, 0x0, 0x4e20, 0x20, 0xa, 0x0, 0x40, 0x0, 0x0, r4}, {0x80, 0x73, 0xc449, 0x7fffffff, 0x2, 0x0, 0xffff, 0x6}, {0x0, 0x80000000, 0x1f, 0x9}, 0x0, 0x6e6bc0, 0x2, 0x0, 0x2}, {{@in6=@local, 0x4d5, 0x3c}, 0xa, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3501, 0x1, 0x3, 0x20, 0x9, 0x7, 0x7ff}}, 0xe8)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4})
preadv(r2, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1850.760611][T16936] usb 5-1: USB disconnect, device number 17
15:50:58 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x1, <r5=>0xffffffffffffffff, 0x1})
dup2(r2, r5)
syz_init_net_socket$llc(0x1a, 0x2, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000280)={0x3, 'veth0_to_bond\x00', {0xfffefffc}, 0x75})
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000100)={0x94}, 0x1)
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000002f6c658d795831bcf08000a00", @ANYRES32, @ANYBLOB="180012210800ab7f707070ac000100e05521458d18bf237bc6274cb1f0fd78a7e700"/47, @ANYRES32=r6], 0x40}}, 0x24000002)
close(r6)
syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x66, 0x400)
r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcsa\x00', 0x200803, 0x0)
ioctl$SNDRV_PCM_IOCTL_DELAY(r7, 0x80084121, &(0x7f0000000140))

[ 1851.109641][T20683] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1851.834885][T20683] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1852.210275][T20651] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1852.218567][T20651] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1852.228611][T20651] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1852.237032][T20651] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1852.245668][T20651] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1852.254201][T20651] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1852.269223][T20651] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1852.287372][T20651] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1852.307466][T20707] ubi0: background thread "ubi_bgt0d" started, PID 20707
[ 1852.317719][T20653] ubi: mtd0 is already attached to ubi0
[ 1852.337646][T20668] ubi0: detaching mtd0
[ 1852.344092][T20668] ubi0: mtd0 is detached
[ 1852.354919][T20671] ubi0: attaching mtd0
[ 1852.360967][T20671] ubi0: scanning is finished
15:50:59 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
shmget(0x1, 0x3000, 0x1, &(0x7f0000ffb000/0x3000)=nil)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000180)={0x5, 0x0, 0x1, 'queue1\x00', 0xb25})
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:50:59 executing program 1:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, &(0x7f00000003c0)=ANY=[@ANYBLOB="06000000000000000400000000000000000000000000000005000000020000000700f8ff0800000000000000000000000000000000000000ffffffff030000000000000000000000e70700000000000000000000000000000000000000000000000000000000000801000000040000000000000000000000e1ffffffffffffff0000000000000000018000000000000000080000020000007f0000000200000000000000000000000800000001000000390000ece600000000000000000000000000000000000000030000000400000000000000000000000101000000080000020000002000000000000000000000000000000000000000ff0000000100000000000000000000000101000006000000090000000200"/296])
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7, 0x0)

[ 1852.488134][T20671] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1852.523351][T20687] ubi0: attaching mtd0
[ 1852.528486][T20687] ubi0: scanning is finished
15:50:59 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x80000000}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = syz_open_procfs(0x0, 0x0)
r2 = gettid()
tkill(r2, 0x1004000000016)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x80, 0xce, 0x1, 0xff, 0x0, 0x3, 0x8010, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x7}, 0xc800, 0xff, 0x9, 0x9, 0x401, 0x5, 0x2}, r2, 0x4, 0xffffffffffffffff, 0x8)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv0\x00', <r4=>0x0})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180)='batadv\x00')
sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)={0x24, r6, 0xf, 0x0, 0x0, {0x11}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}]}, 0x24}}, 0x0)
sendmsg$BATADV_CMD_TP_METER_CANCEL(r1, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, r6, 0x739f3f268a959fa8, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffffc}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x6}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x8894)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, <r7=>0x0}, &(0x7f0000000280)=0x5)
ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f00000000c0)={'batadv0\x00', 0x6})
setuid(r7)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in6=@initdev}, 0x0, @in6=@initdev}}, &(0x7f0000000040)=0xe8)
setreuid(r7, r8)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1852.620537][T20687] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:51:00 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000a007649e5a56d80116bd8ea17e8bfb96b53b761dbdc981604886c558a83b74b33f4fb2dd34b5dadb1bf58335d2610fd8c54e5acac7537954d0a6215bbf49ac7550bcea1b64d5b4f014756fa8f9419cc66aa2de47f742cabb05906f81834b2", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f00000001c0)=""/96, &(0x7f0000000040)=0x60)
close(r1)

15:51:00 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e27666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:00 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x1)
sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, 0x140d, 0x400, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_MRN={0x8}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x1}, @RDMA_NLDEV_ATTR_RES_MRN={0x8}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x404c00d)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1852.848699][T20729] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1852.908411][T20731] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1852.940239][T20732] ubi0: attaching mtd0
[ 1852.979813][T20732] ubi0: scanning is finished
15:51:00 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="40000000c6d33b0e7a00000000000000000000ee", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1853.069383][T20732] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1853.083371][T20732] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1853.103652][T20732] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1853.120283][T20732] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1853.137200][T20732] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1853.156906][T20732] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1853.188221][T20732] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1853.238590][T20732] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1853.297388][T20736] ubi0: background thread "ubi_bgt0d" started, PID 20736
15:51:01 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000540)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)={0x400, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x120, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7f}, @TIPC_NLA_NODE_ID={0x67, 0x3, "787f10c329c0b91406481a0c6f114eed65c9b7e0a4cb006541d7723cede424b4d2a8ed634a558467525408b210402ba12e2f57e0c05ae5cf3e1437267673072ce8915a4980c1d3b75ec350682526daf9a0a9399560bf8e1d078388ec5524b4793d9c8f"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x42, 0x4, {'gcm(aes)\x00', 0x1a, "1925b6bc5047fca7f5d318d037d28a44a6b519343a372bf71f56"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_KEY={0x3e, 0x4, {'gcm(aes)\x00', 0x16, "95794d04d21477e5a4038b5055a23a9a0cb6ceb087df"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ID={0xb, 0x3, "49e4d41fdc4101"}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xa0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x17, 0x1, @l2={'ib', 0x3a, 'veth0_to_bridge\x00'}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x59e21b18}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5f7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}]}, @TIPC_NLA_BEARER={0x148, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x7ff, @empty, 0xfff}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x401, @mcast1, 0x7}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @private=0xa010101}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast2}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @remote}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x39}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x6, @private2={0xfc, 0x2, [], 0x1}, 0x400}}, {0x14, 0x2, @in={0x2, 0x4e20, @rand_addr=0x64010100}}}}, @TIPC_NLA_BEARER_NAME={0x9, 0x1, @l2={'eth', 0x3a, '\x00'}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7, @mcast2, 0xb8a9}}, {0x14, 0x2, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x560}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7ff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x200}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3f}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x44}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_SOCK={0x7c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x101}, @TIPC_NLA_CON_NODE={0x8}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6bbd3485}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x80}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffbff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7fff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xdb}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}]}]}, 0x400}, 0x1, 0x0, 0x0, 0x80}, 0x800)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
ioctl$VIDIOC_DBG_G_REGISTER(r0, 0xc0385650, &(0x7f0000000000)={{0x0, @name="0822934733785123d684741a83ad72517c90c8e72770f44a5199dc442c266a50"}, 0x8, 0x5, 0x8})

15:51:01 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0xffffffffffffffff}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000180)={0x3, 0x0, 0x6, 0x4, 0x2, [{0x4, 0x1, 0x7, [], 0x100}, {0x38c4b86, 0x4, 0xffffffffffffffff, [], 0x100}]})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
prctl$PR_GET_FPEXC(0xb, &(0x7f0000000240))
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:01 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRESHEX=r1, @ANYBLOB="0a002d361f8fa1c612510000", @ANYRES32=0x0, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:01 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="850000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81ab1f05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba029652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78ebb39515991b1428fa00"/234], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x10, &(0x7f0000000240)={0x6})
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f00000002c0), &(0x7f0000000300)=0x4)
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1853.900508][T20757] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1853.928915][T20759] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:51:01 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$BLKBSZGET(r1, 0x80081270, &(0x7f0000000040))
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x6)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r2], 0x40}}, 0x0)
close(r2)

[ 1853.995884][T20756] ubi0: detaching mtd0
[ 1854.087480][T20756] ubi0: mtd0 is detached
[ 1854.113206][T20762] ubi0: attaching mtd0
[ 1854.118098][T20762] ubi0: scanning is finished
[ 1854.248401][T20762] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1854.284220][T20762] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1854.335643][T20762] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
15:51:01 executing program 2:
syz_emit_ethernet(0x2d, &(0x7f0000000040)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @val={@val={0x9100, 0x2, 0x1, 0x3}, {0x8100, 0x3, 0x0, 0xfff}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x17, 0x0, 0x0, 0x0, 0x16, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, "e40000"}}}}, 0x0)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0xa00a00, 0x0)
write$midi(r0, &(0x7f0000000140)="a5b5ec99a902469a928cb1908cd4dbc9858e82a2a84b13d03681ccea62d7d2cdc38e27b6c45f462329b030794e5bee90aad077866e7e876a55317a9dc50e144f68da81ceb3042fad23", 0x49)
ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(0xffffffffffffffff, 0xc0884113, &(0x7f0000000080)={0x0, 0xfffffffb, 0x3f, 0x1, 0xffff, 0x7f, 0x7ff, 0xe5c2, 0x8, 0x9, 0x6, 0x3})

[ 1854.439696][T20762] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1854.477307][T20762] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1854.489914][T20762] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1854.506403][T20762] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1854.552764][T20762] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1854.600054][T20777] ubi0: background thread "ubi_bgt0d" started, PID 20777
[ 1854.874363][T20797] ubi0: detaching mtd0
[ 1854.967967][T20797] ubi0: mtd0 is detached
[ 1855.028233][T20801] ubi0: attaching mtd0
[ 1855.051998][T20801] ubi0: scanning is finished
[ 1855.276984][T20801] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1855.310339][T20801] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1855.319354][T20801] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1855.335521][T20801] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1855.346023][T20801] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1855.384852][T20801] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1855.397590][T20801] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1855.411830][T20801] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1855.428614][T20804] ubi0: background thread "ubi_bgt0d" started, PID 20804
15:51:02 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000180)={{0x3b, @loopback, 0x4e23, 0x3, 'nq\x00', 0x16, 0x8001, 0x3b}, {@private=0xa010102, 0x4e23, 0x10000, 0x2, 0xfffffffb, 0x1f}}, 0x44)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
fstatfs(r1, &(0x7f0000000200)=""/103)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:03 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0x24000, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f00000003c0))
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x8001, 0x0, {0x100, 0x7fffffff}, 0x0, 0xff})
ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000000)={0x2, 0x8})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x200000, 0x0)

15:51:03 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000000)={@dev={[], 0x2a}, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
gettid()

15:51:03 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
write$FUSE_INTERRUPT(r1, &(0x7f0000000200)={0x10, 0x0, 0x6}, 0x10)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ppp\x00', 0x104c2, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x40}}, 0x24008001)
close(r2)
r3 = accept4(r0, &(0x7f00000000c0)=@vsock={0x28, 0x0, 0x0, @host}, &(0x7f0000000040)=0x80, 0xc00)
setsockopt$nfc_llcp_NFC_LLCP_MIUX(r3, 0x118, 0x1, &(0x7f0000000140)=0x3, 0x4)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40046f41, 0x76006e)
openat$cgroup(r4, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0)

15:51:03 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d0000009600000095000000000000000a6c1cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7d0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a6250732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009bcb8026fd80aec7d848362f9a78d7516f8f25bfe91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428faa54710c531c1c01006fa1316e55d1a99d23b8c6198edd78f0820d1fffe3d13dd63840db601b5b99de23a46907db02b1ee33cd2cedc708b4e7585b48b5d84b50c0d7982a74d20888bb50af38462ccb6631e1f594e5e4125b42d49d6f795b2ffc9f6f0af9c1fd4fc3bd34df88c6b4f33baa316b93b566dfbb88d2427578afb474e27432108c7c85d8e6ae664ca8ad8bcd161de3ddfb77ce00e5d4d99107172d20aafad483c4333eb3d70ad5a6c37dd583afc3a79b06b5056aafc7005d70b92a01c6d0000"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snd/seq\x00', 0x101000)
ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r1, 0x8010661b, &(0x7f00000002c0))
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:03 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r2, 0xc0, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r3}, 0x70)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000540)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf200000000000000700000008de00003d0301000000000095000000000000006926000000000000bf67000000000000150600000fff07003506000002000000070600000ee60000bf050000000000000f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad43010000000000950000000000000005000000000000009500000000000000d05bd98c13cc170962b51735140ecd8c3c090c100a72248445f9fa98694f3a88519df1465870fbe7f8c01c982af9f45358e3d439c072c05961f932fde5a905e67bc08627d42de2a4d7936fa2f4d9c817c5f71e0f46c0b890022865a94531b0ec9aec627e77175846bfbcd7c3e23339be6da4d03de41cfb8277313a5798c7f19dde0ef085bde2ed2bb7277330b4d981ee32f81913c7a962a1975e498d6fdecf6fb3086de88ffe7f464c1e1a5953acdb3fa929e51bffed9b9dc694c9f7ea6cc09e1aeacf7619e53699d182719e2b20c57711d31609289beba1b1feb8c391aefbd117821dcd7cbbbf121f2df1106de67144d4ad24cac8eddee39bad50a0740514c931157444b0e64de3a63bf6ac59c192e2587900748454868996204607e5764b8fb3a90e83d45fe514e7d92d507d0edcde4f1bfff50647c290071f1d213874d25f6c09e90aa8862fae08c62b742c4600bb2a02904a6ee16eb742124260bb13fbf6b3f6d24b80b6535541ff42cc7ff5abed394fea339ac6354b97af7262fbf8a0796f5c89228206bcdd4cb1044ec5f0497b789f65b8429a8d3ecb8472c1b5b8d77a67a86fb50c17eabe41f4ea44fd4e0a55b8279f704ae937064af1338e812b638be704fe1b1a9f46f5248171b442223026bda0644e8113c9c64d5bb57fd9d242e071df552dd0614ee6a1d4088828b95310d9"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10, r3}, 0x78)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000001c0)={r0, 0x10, &(0x7f0000000180)={&(0x7f0000000040)=""/22, 0x16, <r4=>r3}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r4}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1856.131515][T20815] ubi0: detaching mtd0
[ 1856.168795][T20815] ubi0: mtd0 is detached
15:51:03 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000100)=ANY=[], 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x15553c526ecfac32, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, &(0x7f0000000240)={0xfffffffc, 0x0, 0xfff, 0x7, 0x3f})
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
accept(0xffffffffffffffff, &(0x7f00000001c0)=@pppoe={0x18, 0x0, {0x0, @remote}}, &(0x7f0000000340)=0x80)
connect$l2tp6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x400, @private2={0xfc, 0x2, [], 0xff}, 0x200ff, 0x801}, 0x20)
r4 = gettid()
tkill(r4, 0x1004000000016)
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000003c0)={0x0, <r5=>0x0})
r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000380)='/dev/video37\x00', 0x2, 0x0)
kcmp(r4, r5, 0x2, r6, r0)
r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r7, 0x40186f40, 0x76006e)
setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x0, 0x0, 0x4e, 0x0, "396770ce9e30fc159479f6698a7d120e4ad609312144352d7a1560291d92591a6d96c32cb8fa0740ada4f64660491d4bda3c02036dd7ff05c93f6e510c062db71b4ce0c080b02fae3cb3be6ab8c20145"}, 0xd8)
setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000002c0)=@known='trusted.overlay.metacopy\x00', &(0x7f0000000300)='VF\xa0\x80\x95', 0x5, 0x3)

[ 1856.295892][T20821] ubi0: attaching mtd0
[ 1856.307488][T20821] ubi0: scanning is finished
15:51:03 executing program 4:
socket$nl_route(0x10, 0x3, 0x0)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
close(r0)
fsetxattr(r0, &(0x7f0000000040)=@random={'os2.', 'trusted.overlay.redirect\x00'}, &(0x7f0000000080)='*!\x00', 0x3, 0x6)

[ 1856.490335][T20821] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1856.504435][T20821] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1856.537741][T20821] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
15:51:03 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000007301000abe", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1856.580281][T20821] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1856.652474][T20821] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1856.667242][T20821] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1856.678197][T20821] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1856.694970][T20821] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1856.736927][T20833] ubi0: background thread "ubi_bgt0d" started, PID 20833
[ 1856.744338][T20828] ubi: mtd0 is already attached to ubi0
[ 1856.821697][T20840] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:51:04 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x17c5a19b94046ddf, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x52c65b00, 0x6, 0x0, {0x1, 0x7fffffff}, 0x0, 0xff})
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
ioctl$KVM_S390_VCPU_FAULT(r1, 0x4008ae52, &(0x7f0000000000)=0x8)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:51:04 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000800)=[{&(0x7f00000003c0)=""/154, 0xfffffffffffffd85}, {&(0x7f0000000240)=""/58, 0x3a}, {&(0x7f00000002c0)=""/34, 0x22}, {&(0x7f0000000480)=""/165, 0xa5}, {&(0x7f00000005c0)=""/124, 0x7c}, {&(0x7f0000000300)=""/63, 0x3f}, {&(0x7f0000000880)=""/146, 0x92}, {&(0x7f0000000780)=""/96, 0x60}], 0x8, 0x3)
connect$x25(r0, &(0x7f0000000540)={0x9, @remote={[], 0x2}}, 0x12)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:04 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
shmget(0x1, 0x2000, 0x40, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000180)={{0x1, 0x80}, 0x0, 0x400, 0x1f, {0x2, 0x4a}, 0x3f, 0xa88})
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r2 = getpid()
syz_open_procfs(r2, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r3 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r3, 0x0, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r3, 0x400448c9, &(0x7f0000000040)={@fixed={[], 0x11}, 0x8000})

[ 1856.876726][T20846] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1856.982340][T20849] ubi: mtd0 is already attached to ubi0
[ 1857.081341][T20852] ubi0: detaching mtd0
[ 1857.156162][T20852] ubi0: mtd0 is detached
[ 1857.281698][T20860] ubi0: attaching mtd0
[ 1857.304282][T20860] ubi0: scanning is finished
[ 1857.448304][T20860] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1857.462902][T20860] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1857.481978][T20860] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1857.499660][T20860] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1857.524935][T20860] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1857.558275][T20860] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1857.585741][T20860] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1857.608408][T20860] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1857.637516][T20864] ubi0: background thread "ubi_bgt0d" started, PID 20864
[ 1857.644865][T20847] ubi0: detaching mtd0
[ 1857.671433][T20847] ubi0: mtd0 is detached
15:51:05 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
write$binfmt_misc(r1, &(0x7f0000000000)={'syz1', "078a0c1dc2efa0d9b3eb828d4943e7691b12551d4d7e70467dbcf1b65c18dfba49da388f83590d9c14db5d5381d8c286d2c76fdf39fa09be0662b945e846df19f70818a1a51e01dc44603c58a8fa45974e29aee360"}, 0x59)
syz_open_procfs(0x0, 0x0)
ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:51:05 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYRES64=r2, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="182212000800010070703a0eb16a46d40153ca53a44d00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:05 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r2, 0xc0, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r3}, 0x70)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000540)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf200000000000000700000008de00003d0301000000000095000000000000006926000000000000bf67000000000000150600000fff07003506000002000000070600000ee60000bf050000000000000f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad43010000000000950000000000000005000000000000009500000000000000d05bd98c13cc170962b51735140ecd8c3c090c100a72248445f9fa98694f3a88519df1465870fbe7f8c01c982af9f45358e3d439c072c05961f932fde5a905e67bc08627d42de2a4d7936fa2f4d9c817c5f71e0f46c0b890022865a94531b0ec9aec627e77175846bfbcd7c3e23339be6da4d03de41cfb8277313a5798c7f19dde0ef085bde2ed2bb7277330b4d981ee32f81913c7a962a1975e498d6fdecf6fb3086de88ffe7f464c1e1a5953acdb3fa929e51bffed9b9dc694c9f7ea6cc09e1aeacf7619e53699d182719e2b20c57711d31609289beba1b1feb8c391aefbd117821dcd7cbbbf121f2df1106de67144d4ad24cac8eddee39bad50a0740514c931157444b0e64de3a63bf6ac59c192e2587900748454868996204607e5764b8fb3a90e83d45fe514e7d92d507d0edcde4f1bfff50647c290071f1d213874d25f6c09e90aa8862fae08c62b742c4600bb2a02904a6ee16eb742124260bb13fbf6b3f6d24b80b6535541ff42cc7ff5abed394fea339ac6354b97af7262fbf8a0796f5c89228206bcdd4cb1044ec5f0497b789f65b8429a8d3ecb8472c1b5b8d77a67a86fb50c17eabe41f4ea44fd4e0a55b8279f704ae937064af1338e812b638be704fe1b1a9f46f5248171b442223026bda0644e8113c9c64d5bb57fd9d242e071df552dd0614ee6a1d4088828b95310d9"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10, r3}, 0x78)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000001c0)={r0, 0x10, &(0x7f0000000180)={&(0x7f0000000040)=""/22, 0x16, <r4=>r3}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r4}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:05 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
r2 = open(&(0x7f0000000300)='./bus\x00', 0x0, 0x0)
getdents(r2, 0x0, 0x0)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100)='nl80211\x00')
sendmsg$NL80211_CMD_GET_INTERFACE(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x34, r3, 0x402, 0x70bd28, 0x25dfdbfd, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x80000000, 0x4}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x9, 0xffffffffffffffff}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0xc880)
sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000826bdf8dc5ed611800400010004000400040002000400068000000000000000ff"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x20040000)
ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000180)=""/193)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:05 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b1073ff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa935fe0b48bb6b4f908e5a0654edddf0c4a2de427bab0ea57f69afbfff4e17b55c320dab4d9d0f177cd06d85a85f26389210c3a8ec39902dbf4c60000000000000000"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1858.412316][T20891] ubi0: attaching mtd0
[ 1858.423749][T20891] ubi0: scanning is finished
15:51:05 executing program 4:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
utimensat(r1, &(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={{0x0, 0x2710}, {0x0, 0xea60}}, 0x100)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={<r2=>0x0}, &(0x7f0000000340)=0xc)
ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r0, 0xc1105518, &(0x7f00000003c0)={{0x4, 0x3, 0xb4, 0x3, 'syz0\x00', 0xfffffffa}, 0x4, 0x20000000, 0x1800, r2, 0x2, 0xffffff2c, 'syz0\x00', &(0x7f0000000380)=['/dev/ubi_ctrl\x00', '\x00'], 0xf, [], [0x4a60, 0x8000, 0xc3b, 0x6]})
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003bf83d52c3d11a786583679fdd2711e444a7c497c02f10806b672aadd0e024bcb8fd6865971c9b5e08ed71ab485c51a875b2065c0e4603667490b0ad981f298bdb2964d5d4cd339efddb3a2042b2b7", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="18001270000c00020008000100", @ANYRES32=r4], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$KVM_PPC_GET_SMMU_INFO(r6, 0x8250aea6, &(0x7f0000000240)=""/236)
close(r4)
r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r7, 0x40046f41, 0x76006e)
bind$bt_rfcomm(r7, &(0x7f0000000580)={0x1f, @none, 0x2}, 0xa)
getsockopt$inet_sctp6_SCTP_NODELAY(r7, 0x84, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4)

[ 1858.612093][T20891] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1858.625664][T20891] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1858.655508][T20891] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1858.671807][T20891] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1858.689442][T20891] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1858.721126][T20891] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1858.755175][T20891] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1858.763856][T20908] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1858.789441][T20891] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1858.840334][T20902] ubi0: background thread "ubi_bgt0d" started, PID 20902
[ 1858.847751][T20903] ubi: mtd0 is already attached to ubi0
[ 1858.877845][T20905] ubi0: detaching mtd0
[ 1858.886322][T20905] ubi0: mtd0 is detached
[ 1858.916661][T20903] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:51:06 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
setsockopt$CAIFSO_REQ_PARAM(r0, 0x116, 0x80, &(0x7f0000000080)="b13af9b25d5bb279498dada4962fab09a1bd3483e052bf759a16ee309d92fdf781d24307b93568b3dda047d2cdb2c81ef2b706282657099192040d1f886ff7093849eaf80b2e1d54ded802bd31b7b65b57098473909f0f6c57ddf31f5070f7c6667ae85a4b056732c2091ca7a2f76ba73b0b8756e94bfdc1857f6d0eedf9a92f6d3675ffa2da99c7651c2841eb452e6923194101ea1e76e431e96d6e0d60b25f823eaf0d9b75ef0912472a445f783616af02", 0xb2)

15:51:06 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x3, 0x3}, 0x10)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000040)={'macvlan1\x00', {0x2, 0x4e20, @private=0xa010100}})

15:51:06 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x1, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:06 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x4000, 0x40, &(0x7f0000ffc000/0x4000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
symlinkat(&(0x7f0000000240)='./file0\x00', r1, &(0x7f00000002c0)='./file1\x00')
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:06 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="18001200080001007070700e00000200080001000082cbf20921e8c5dd6fbd8ce46c6a27d01f606723931acc9bea590bea5c6ec8f3b8e25e3b8ea4c0e058c40327c1cf629a0fe9aae66a6c95f59dabaa704d30d30bbfe6", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:06 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="9f0a010018000000000000000c0c000000020000000000080000000000e67bd296f7e942000000001ca5eda42f09aacc0dd5e3cab405161fa88a7dd277b1a076108e27063c2742af38a80cdd29b9da2f6b24652b3a934136946b60880bc7529bdfa473a9cfb7731d46402734432f3bf81a229ed8ddd7cfb1eb25f1d6f996dadefdcb852e8e9397ffc3bcb35d9d3497ca1a5a720956d52963d3fe6239ecf4b592b6dfb4b2d539a3937083ac4cd70ff3a83d9f3e64cae6e2dbbcf651be01abcd7f4bedb0fa6bfe66fd082448324c2203789665ce9a3c8f6c9a8bbcf5525551f8f3f755b2d3"], 0x0, 0x26}, 0x20)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r2, 0xc0, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x8, [], 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r4, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r5, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1859.387110][T20927] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1859.507709][T20935] ubi0: attaching mtd0
[ 1859.519694][T20935] ubi0: scanning is finished
[ 1859.544416][T20932] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1859.745330][T20935] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1859.768531][T20935] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
15:51:07 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000040))
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
sendmsg$NLBL_UNLABEL_C_LIST(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa4, 0x0, 0x0, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1={0xfc, 0x1, [], 0x1}}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @dev={0xfe, 0x80, [], 0x16}}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:var_spool_t:s0\x00'}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4015}, 0x850)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
fstatfs(r3, &(0x7f0000000180)=""/95)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1859.795105][T20935] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1859.820353][T20935] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1859.868182][T20935] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1859.900216][T20935] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1859.927383][T20935] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1859.975381][T20935] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1860.030486][T20944] ubi0: background thread "ubi_bgt0d" started, PID 20944
[ 1860.037886][T20937] ubi0: detaching mtd0
[ 1860.051247][T20937] ubi0: mtd0 is detached
[ 1860.068862][T20939] ubi0: attaching mtd0
[ 1860.075878][T20939] ubi0: scanning is finished
15:51:07 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_emit_ethernet(0x56, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r1], 0x0)
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x220000)

15:51:07 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x40, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f0000000000)={r2})
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1860.213945][T20939] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1860.250924][T20939] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1860.275635][T20939] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1860.309149][T20939] ubi0: VID header offset: 64 (aligned 64), data offset: 128
15:51:07 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000080)={{0x0, @broadcast, 0x4e24, 0x4, 'lc\x00', 0x4, 0x7, 0x35}, {@local, 0x4e21, 0x2, 0x6, 0x1, 0x60}}, 0x44)

[ 1860.344607][T20939] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1860.367601][T20939] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1860.396254][T20939] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1860.421379][T20939] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1860.487432][T20958] ubi0: background thread "ubi_bgt0d" started, PID 20958
[ 1860.495938][T20947] ubi0: detaching mtd0
[ 1860.574327][T20947] ubi0: mtd0 is detached
[ 1860.592811][T20978] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20004
15:51:08 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d060000000000809829652b10737d4e25a22695df1cff25340af4fc00000000000000004f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0)='devlink\x00')
sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x3c, r3, 0x1, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x2}}]}, 0x3c}}, 0x8000)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1860.660783][T20986] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20004
15:51:08 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
syz_emit_ethernet(0xe8, &(0x7f0000000100)={@random="9ed5113963f9", @link_local, @void, {@x25={0x805, {0x1, 0x6, 0x1f, "9cf0eca90c9fc18aef9fc52b126ec6d878615cd51e2d3d7f5144828f90a75bac5b3faca21b13974a2e9292372448bb7d215d3b9eb8066db4826b696db1c3ab57041276d4e01ca42ee4f626cec0ac56b6b053d38dcdcc08c6e2998540b60e089b5c78117a06f7604a47493240028a7d9f1253df03fe830781cb8f9f7bb91461f4865076bed7afc8b3252d5054499067d71476752c0ef568db79f80fb165b9129d4f831a587d84cb3933512f5230b1c2e6e5ea436ff82dbbb14e8e11b79eb47aeb1e7cde867dd366cca62794bb5736887da9b9112773e8c6"}}}}, &(0x7f0000000200)={0x1, 0x2, [0xca3, 0x19, 0x9cd, 0xfac]})
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x151100, 0x0)
ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f00000000c0)={{}, 0x19, 0xf0, &(0x7f0000000080)="2fdb82d43ff91fe4e3a99543a97df6a4419603280536adabdd"})

15:51:08 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
sendmsg$NFNL_MSG_CTHELPER_GET(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0xbc, 0x1, 0x9, 0x201, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFCTH_TUPLE={0x90, 0x2, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @remote}}}]}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x5}, @NFCTH_STATUS={0x8}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4004}, 0x400c001)
r2 = syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f0000000000)=0x3)

15:51:08 executing program 2:
prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000))
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000100080045000018001d000000c39078ac1e0001ffffffff03000000"], 0x0)

[ 1860.999623][T20995] ubi0: attaching mtd0
[ 1861.038024][T20995] ubi0: scanning is finished
15:51:08 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$TIOCL_UNBLANKSCREEN(r0, 0x541c, &(0x7f00000001c0))
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000004c0)={0x3, 0x0, 0x1, {0x1, 0x7fffffff}, 0x6, 0x2000ff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x400001, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x1, 0x0, 0x10001, 0x8001})
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="840000000206010100000000000000000300000a05000100070000000900020073797a32000000000500010007000000100003006269746d61703a706f7274000500040002000000050001000700000005000400030000001400078008001240000007fe050007006700000000000780000017400000000800000b400000000400000840000000800000140003000000000003000000200000001340000000040000028000000140ac1e0101000005404e240000000009400000001f000008400000000c0500040000000000"], 0x84}, 0x1, 0x0, 0x0, 0x1}, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video1\x00', 0x2, 0x0)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r2, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, 0x140a, 0x800, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004)

15:51:08 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x145100, 0x0)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000080))
socket$pptp(0x18, 0x1, 0x2)

[ 1861.187275][T20995] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1861.208136][T20995] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1861.242864][T20995] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1861.284176][T20995] ubi0: VID header offset: 64 (aligned 64), data offset: 128
15:51:08 executing program 2:
socket$pptp(0x18, 0x1, 0x2)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000000)={{0x4, 0x0, @reserved="d352323a243307997fed91d3759341d980a21eba34cdcc2099184550c57ab39f"}})

[ 1861.407041][T20995] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1861.444225][T20995] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1861.496850][T20995] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1861.538408][T20995] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1861.580021][T21002] ubi0: background thread "ubi_bgt0d" started, PID 21002
[ 1861.592465][T20994] ubi0: detaching mtd0
[ 1861.654392][T20994] ubi0: mtd0 is detached
15:51:10 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d060000000000809829652b10737d4e25a22695df1cff25340af4fc00000000000000004f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0)='devlink\x00')
sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x3c, r3, 0x1, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x2}}]}, 0x3c}}, 0x8000)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:10 executing program 4:
r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsa\x00', 0x24000, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280)='mptcp_pm\x00')
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001dc0)={0x14, r2, 0x1, 0x0, 0x0, {0x2}}, 0x14}}, 0x0)
sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x34, r2, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x2404c000}, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r4], 0x40}}, 0x0)
close(r4)
r5 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
flock(r5, 0x2)
r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
dup2(r6, r5)
r7 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040)='/dev/input/mice\x00', 0x800)
r8 = syz_genetlink_get_family_id$net_dm(0x0)
sendmsg$NET_DM_CMD_STOP(r7, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x14, r8, 0x300, 0x70bd2c, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x48004}, 0x8010)
sendmsg$NET_DM_CMD_START(r5, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000680)={0x14, r8, 0x300, 0x5, 0x25dfdbff, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0xc014}, 0x0)
sendmsg$NET_DM_CMD_STOP(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r8, 0x100, 0x70bd27, 0x25dfdbff, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x800)

15:51:10 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000240)={'ip_vti0\x00', &(0x7f00000002c0)={'gre0\x00', <r1=>0x0, 0x80, 0x20, 0x101, 0x1f, {{0xc, 0x4, 0x0, 0x6, 0x30, 0x68, 0x0, 0x81, 0x29, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@end, @noop, @noop, @end, @timestamp={0x44, 0x8, 0x8d, 0x0, 0x4, [0x0]}, @generic={0x82, 0xf, "8ec0d7f723564a11e9ca33d36b"}, @noop]}}}}})
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], r1, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000440)='devlink\x00')
sendmsg$DEVLINK_CMD_SB_GET(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x60, r5, 0x100, 0x70bd27, 0x25dfdbfe, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0xb, 0xffff}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}]}, 0x60}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:10 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r6, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={0x0, @can={0x1d, r6}, @ethernet={0x1, @dev={[], 0x30}}, @ax25={0x3, @null, 0x3}, 0x9, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000000)='macvlan0\x00', 0xfd8, 0x5, 0x1})

15:51:10 executing program 0:
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
ioctl$VIDIOC_S_AUDIO(r0, 0x40345622, &(0x7f0000000000)={0x4, "8e1262579ab3fb11435768e26c03591c21506efcca88ef2124b0fc3b7f09a8b1", 0x2, 0x1})
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x3}, 0x20}, 0x0, 0xffffffffffffffff, r1, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$int_out(r4, 0x5460, &(0x7f0000000040))
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1863.421993][T21039] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:51:10 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1863.579063][T21062] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1863.601465][T21061] ubi0: attaching mtd0
[ 1863.627518][T21061] ubi0: scanning is finished
15:51:11 executing program 2:
select(0x40, &(0x7f0000000000)={0x7fff, 0x2, 0x6, 0x8001, 0xffffffffffffffbd, 0x6, 0x8, 0x800}, &(0x7f0000000080)={0x2, 0x11, 0x8001, 0x9, 0x3ff, 0xff, 0x100}, &(0x7f00000000c0)={0x101, 0x8, 0x92, 0x401, 0xfffffffffffffffd, 0x9, 0x3, 0x5}, &(0x7f0000000100)={0x0, 0xea60})
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

[ 1863.794216][T21061] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1863.819952][T21061] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
15:51:11 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="18001200080094fa1a191c6d586d01007a4713707070e7", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1863.868881][T21061] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1863.886692][T21061] ubi0: VID header offset: 64 (aligned 64), data offset: 128
15:51:11 executing program 2:
syz_emit_ethernet(0x46, &(0x7f0000000080)={@local, @link_local, @val={@val={0x9100, 0x1, 0x0, 0x4}, {0x8100, 0x0, 0x1, 0x2}}, {@ipv4={0x800, @generic={{0xb, 0x4, 0x0, 0x3, 0x30, 0x40, 0x0, 0x0, 0x73, 0x0, @private=0xa010102, @remote, {[@rr={0x7, 0xb, 0x67, [@multicast1, @empty]}, @rr={0x7, 0x7, 0x57, [@loopback]}, @ra={0x94, 0x4, 0x1}]}}, "03000000"}}}}, 0x0)

[ 1863.923675][T21061] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1863.955093][T21061] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1864.001281][T21061] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1864.017745][T21083] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1864.065666][T21061] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1864.082332][T21086] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1864.123490][T21075] ubi0: background thread "ubi_bgt0d" started, PID 21075
[ 1864.134778][T21076] ubi0: detaching mtd0
15:51:11 executing program 2:
openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x7be5c232451b27fe)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000200)=""/228)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x200000, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f00000000c0)=r3)
syz_emit_ethernet(0x26, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000180000000000739078ac00040000ffffff03000000897eeacf2f1bd1494b1ef4762d3e162fa2b06b6e1579fb083c01aa9fd094fbee6bfc4afc7328f6066dd2c9177aab8d510a12fe87e8fde0313a44e8b9993917e61cbb93fc5c274dd6f55650f5367d2c3272e34d11de48d50b9908fd278f1aa44dcb9f48e793c60799e5db7bce04aae2e21a3f0023ccb05a90a023e57847dcedbe9aedfc03a73600ffd6d9c8a8c67bc50ca0d906068d75bef3c3a5ca62833f1043a96b004950c81f56299303939270cf09d800"/226, @ANYRES32=0x0, @ANYRES16=r1], 0x0)

[ 1864.208524][T21076] ubi0: mtd0 is detached
15:51:11 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/ip6_tables_targets\x00')
getsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000140)=0x7, &(0x7f00000001c0)=0x2)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r2], 0x40}}, 0x0)
ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000040)={{}, 0x7fffffff, 0x2, 0x401})
close(r2)

15:51:11 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000780)={0xfffffffc, 0x9, 0x40000001, {0x0, 0x7fffffff}, 0xc88d, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000480)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
preadv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000600)=""/220}, {&(0x7f0000001900)=""/4096}, {&(0x7f0000002900)=""/4096}], 0x1000000000000118, 0x4)
openat$dsp(0xffffffffffffff9c, &(0x7f0000000740)='/dev/dsp\x00', 0x1, 0x0)
ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00000018c0)={0x4, <r1=>0xffffffffffffffff})
dup2(0xffffffffffffffff, r1)
sendmsg(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000002c0)=@l2={0x1f, 0x401, @fixed={[], 0x12}, 0x3, 0x2}, 0x80, &(0x7f0000000240)=[{&(0x7f00000003c0)="b1e85d237d495da87a57370f0a73e8376e667a8c20cc8063980cdecb4fc8141c7a41800485908c6ddf6795c2fe858b07b4283db79bf2c3af5ea95ca66eaddfc536a1e4b6c6e4eda78c97b32c13484446b30dffc9ae3b983a77eb26", 0x5b}], 0x1, &(0x7f0000005d80)=ANY=[@ANYRESHEX], 0x1108}, 0x4f858b1fae21d5c4)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1864.541948][T21110] ubi0: attaching mtd0
[ 1864.546810][T21110] ubi0: scanning is finished
[ 1864.662778][T21110] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1864.681588][T21110] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1864.706703][T21110] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1864.744554][T21110] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1864.769828][T21110] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1864.796098][T21110] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1864.819822][T21110] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1864.849092][T21110] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1864.887840][T21115] ubi0: background thread "ubi_bgt0d" started, PID 21115
[ 1864.898994][T21112] ubi0: detaching mtd0
[ 1864.913393][T21112] ubi0: mtd0 is detached
[ 1864.940375][T21110] ubi0: attaching mtd0
[ 1864.945999][T21110] ubi0: scanning is finished
[ 1865.079784][T21110] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:51:14 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbaf03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c1680100a716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa0000000000002e2a7fae3ac33411d83bc742c0874886d6b884d4b72704"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:14 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x801, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffffffd}, 0x0, 0x6, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000000)=<r2=>0x0)
ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000180))
r3 = gettid()
tkill(r3, 0x1004000000016)
ioctl$USBDEVFS_CLAIM_PORT(r0, 0x80045518, &(0x7f0000000040)=0xffff)
syz_open_procfs(r2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r6=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r6}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000040)={r6, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f00000000c0)={<r7=>r6, 0x100, 0x4, [0x0, 0x3, 0x7626, 0x1ff]}, &(0x7f0000000200)=0x10)
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000240)=@sack_info={r7, 0x2e5, 0xffff}, 0xc)

15:51:14 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@empty, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @multicast1, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f0000000000)={0x9, 0x8})

15:51:14 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
ioctl$sock_SIOCDELRT(r1, 0x890c, &(0x7f00000001c0)={0x0, @ipx={0x4, 0x7f, 0x80000001, "c827ce33e166", 0x46}, @qipcrtr={0x2a, 0x1, 0x7fff}, @ax25={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x7}, 0x6, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000140)='sit0\x00', 0x100, 0x7fff, 0x100})
r5 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control\x00', 0xc4400, 0x0)
io_uring_register$IORING_UNREGISTER_FILES(r5, 0x3, 0x0, 0x0)
write$qrtrtun(r5, &(0x7f00000000c0)="a1a38af9dce8109cc0a19e384f1a71cfd6e721e3910d083c201ec24a64c42a36b9d9a05a5dd3a1a359885cb9b0a5", 0x2e)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
timer_settime(0x0, 0x1, &(0x7f0000000240)={{0x77359400}}, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f00000018c0)={0x4})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x80010, r7, 0x8d196000)
r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r8], 0x40}}, 0x0)
close(r8)

15:51:14 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d000000006f5c51bfebbd157b693800000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189983feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
write$6lowpan_control(r0, &(0x7f0000000240)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:14 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4})
r3 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r3, 0x0, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000180)={0x6, <r4=>r3})
ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f00000001c0)={&(0x7f0000000040)=[0x80000001, 0x3, 0x8, 0xdb4, 0x4b5, 0x3, 0x4, 0x7, 0x8001, 0x8], 0xa, 0x80800, 0x0, r4})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:14 executing program 2:
syz_emit_ethernet(0xa3, &(0x7f0000000180)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0x1a, 0x4, 0x3, 0x7, 0x95, 0x68, 0x0, 0x40, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102, {[@ra={0x94, 0x4, 0x1}, @end, @lsrr={0x83, 0x17, 0xaf, [@multicast1, @broadcast, @loopback, @dev={0xac, 0x14, 0x14, 0x10}, @private=0xa010100]}, @lsrr={0x83, 0x23, 0xde, [@empty, @remote, @loopback, @rand_addr=0x64010101, @empty, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101]}, @lsrr={0x83, 0x7, 0xfd, [@rand_addr=0x64010100]}, @timestamp={0x44, 0xc, 0x64, 0x0, 0xd, [0x852, 0x0]}]}}, @payload_named={{{{{0x2d, 0x0, 0x0, 0x0, 0x1, 0xa, 0x0, 0x2, 0xffff, 0x0, 0x1, 0x7, 0x3, 0x2, 0x4, 0x3, 0x0, 0x4e24, 0x4e24}, 0x3, 0x3}, 0x1, 0x4}}, [0x0, 0x0, 0x0, 0x0, 0x0]}}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x2000, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
recvfrom$rxrpc(r0, &(0x7f0000000000)=""/75, 0x4b, 0x40010140, &(0x7f0000000140)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e21, @multicast2}}, 0x24)

[ 1867.032471][T21154] ubi0: attaching mtd0
[ 1867.071739][T21154] ubi0: scanning is finished
15:51:14 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x41}, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$IMGETCOUNT(r4, 0x80044943, &(0x7f0000000140))
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
getsockname$netrom(r4, &(0x7f00000000c0)={{}, [@rose, @null, @netrom, @default, @rose, @null, @rose, @rose]}, &(0x7f0000000040)=0x48)
close(r1)

15:51:14 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
r2 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r4=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r4}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000040)={r4, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000040)={0x4, 0x4, 0xffffffff, 0x3, r4}, &(0x7f0000000180)=0x10)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1867.250850][T21154] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1867.282646][T21154] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1867.322368][T21154] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1867.354868][T21154] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1867.398713][T21154] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1867.440983][T21154] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1867.467647][T21154] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
15:51:14 executing program 4:
r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040)='/dev/input/mice\x00', 0x480040)
r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100)='wireguard\x00')
sendmsg$WG_CMD_GET_DEVICE(r0, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000580)=ANY=[@ANYBLOB="146e901d5bebfcc3b832f9b08a36f947f670a61373922555b3901c2a00004f810048960000000000000000", @ANYRES16=r1, @ANYBLOB="010026bd7000fcdbdf2500000000"], 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0x4000044)
setsockopt$SO_J1939_PROMISC(r0, 0x6b, 0x2, &(0x7f00000001c0), 0x4)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000200)={0xf728a0a0, 0x1, 0x0, 'queue1\x00', 0x3})
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="4000000010003b0e7a00800000000000000000005024247bd0471974ebbbf232bbe05b03c6816c8b2e6354b4521619f580a72ad43ab89e0edd0326922e705a63b79b67a5680c10557de418aca15576ef551e0639e95517c68badb9", @ANYRES32=0x0, @ANYBLOB="000000000600ef5e17ee0a00f70654b2aa6f6f16312aa8b3cd0340df6cf00705b84fdab08152adcad4312e3220580cf4e1ae7da366286505897c44420dc8b3881468f9e97f9feb8af696b6fda5ba2cc7cc549656a5fb59ed87d0bc819f96bc87827e0148850d0d9524d8e5c84553d5f467f0d13101e1eeb85497d1fcb40373bff14b5bc187dade17075f8a36897a86494459fccb61f83081c71f26952f3a9d812c3013d6567dae38ad6dd92333eec5907e644b1691b5b8e1c71d412df476db015babbae8e7c827a1c2d703e4798ca1", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100be74d435b236671a5063fa8312c007a3a2240cbb3a1e1e8b48b8058b73fe801d27515ed485401e0ea91c3040fa730a799582ae6239013c3350c463873d846355aa790f947f0b0a0e5de176057563ab75f908d9b42a2069ab707e8353f7e85f8bdc85fc3d2b42ef7b642ca06476bdc24e4d10b1a5750d6f0b7d48e9aab0d602feb4d6bef799db620cd56890ce2c2d10506edaca2f1f3d38506f628ff91ae898aeb87e6a9341d97fa8e500a400133a361e810dffbba487bfee4befc703a44e8082479bc482056e7cc7ac59197cff6201671cdd3aab", @ANYRES32=r3], 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000400)={0x9d0000, 0x40, 0x1, <r4=>0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x9a0a1f, 0x28, [], @p_u16=&(0x7f0000000140)=0xffff}})
ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r4, 0xc0bc5310, &(0x7f00000004c0))
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r5, 0x40046f41, 0x76006e)
ioctl$SCSI_IOCTL_PROBE_HOST(r5, 0x5385, &(0x7f0000000380)={0x6e, ""/110})
close(r3)
inotify_init1(0x0)

[ 1867.497852][T21154] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1867.539674][T21173] ubi0: background thread "ubi_bgt0d" started, PID 21173
[ 1867.554294][T21178] ubi0: detaching mtd0
15:51:14 executing program 2:
r0 = creat(&(0x7f0000000000)='./file0\x00', 0x80)
ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000080)={0x401, 0x6, 0x4, 0x1000, 0xffffffff, {0x77359400}, {0x5, 0x0, 0xff, 0x3, 0x7, 0x6, "89c5a936"}, 0x68744fc7, 0x4, @offset=0x800, 0x7})
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000000080045227b3c45890c9bad7390785f0b6905ac1e0001ffffffff"], 0x0)

[ 1867.623448][T21178] ubi0: mtd0 is detached
15:51:15 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000018c0)={0x4})
fcntl$notify(r1, 0x402, 0x8000003e)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1867.657527][T21191] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1867.724740][T21191] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1867.952385][T21201] ubi0: attaching mtd0
[ 1867.964503][T21201] ubi0: scanning is finished
[ 1868.065112][T21201] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1868.075534][T21201] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1868.084944][T21201] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1868.093899][T21201] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1868.103418][T21201] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1868.111185][T21201] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1868.119423][T21201] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1868.131686][T21201] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1868.143885][T21206] ubi0: background thread "ubi_bgt0d" started, PID 21206
[ 1868.515436][T21208] ubi: mtd0 is already attached to ubi0
15:51:16 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000018c0)={0x4})
fcntl$notify(r1, 0x402, 0x8000003e)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1869.312060][T21225] ubi0: detaching mtd0
[ 1869.389509][T21225] ubi0: mtd0 is detached
15:51:17 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000040)={'ipvs\x00'}, &(0x7f00000000c0)=0x1e)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r4, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r5 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r5, 0x84, 0xf, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e24, 0x5, @private0, 0x9}}, 0xfffffff7, 0x2, 0x4, 0x81, 0x6}, &(0x7f0000000000)=0x98)

15:51:17 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x2, 0x1000, 0xff0fb7daf9a21463, &(0x7f0000fff000/0x1000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:17 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="001912000000000008000a00", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:17 executing program 2:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'virt_wifi0\x00', 0x4000})
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

15:51:17 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000002c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000240)={0x0, 0x80000})
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:17 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xc000}, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="9e3559f940ec82b41a3042579b6f69d196f64c7bb1"], 0x24}, 0x8}, 0x0)
sendto$netrom(0xffffffffffffffff, 0x0, 0x0, 0x20000000, 0x0, 0x0)
prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00')
r2 = getpid()
sched_setscheduler(r2, 0x5, &(0x7f0000000380))
openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x0, 0x0)
ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, 0x0)
preadv(r1, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
ioctl(r4, 0x0, &(0x7f0000000140)="28d952d41dd7d5f75b1a70e298cccf50ae9205e11c7b2f55ef06")
syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x0, 0x121041)
creat(0x0, 0x0)

[ 1869.842020][T21236] device ppp0 entered promiscuous mode
15:51:17 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYRES64=r1, @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1870.084381][T21259] ubi0: attaching mtd0
[ 1870.131224][T21259] ubi0: scanning is finished
15:51:17 executing program 2:
fchdir(0xffffffffffffffff)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611)

[ 1870.223067][T21269] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:51:17 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
getsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000040), &(0x7f0000000180)=0x4)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:17 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x10000, 0x0)
fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000040)='lazytime\x00', 0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1870.334262][T21272] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:51:17 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x3, 0x0)
ioctl$VIDIOC_DBG_G_CHIP_INFO(r2, 0xc0c85666, &(0x7f00000001c0)={{0x2, @addr=0x9}, "7c5899794adb62f4aca8824a496b7e48b9ff0953c384576cf810a71cb098aa40"})
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:17 executing program 2:
syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000004c90130238f1e000800450000180000000000739078ac1e0001ffffffff0300"], 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
getrlimit(0x0, &(0x7f0000000180))
ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000140)=@req={0x28, &(0x7f0000000100)={'veth1_to_bridge\x00', @ifru_addrs=@ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x2}}})
r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x42900, 0x0)
r5 = request_key(&(0x7f00000001c0)='.request_key_auth\x00', &(0x7f0000000200)={'syz', 0x3}, &(0x7f0000000240)='\x00', 0xfffffffffffffffd)
keyctl$KEYCTL_PKEY_QUERY(0x18, r5, 0x0, &(0x7f0000000280)='\x00', &(0x7f00000002c0))
ioctl$RTC_IRQP_SET(r4, 0x4008700c, 0x1007)
r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f00000018c0)={0x4, <r9=>0xffffffffffffffff})
dup2(r6, r9)
ioctl$sock_SIOCGIFBR(r6, 0x8940, &(0x7f0000000000)=@generic={0x2, 0x6, 0x8001})

[ 1870.395319][T21259] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1870.415324][T21259] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1870.485423][T21259] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1870.541585][T21259] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1870.556632][T21296] Unknown ioctl -1060612506
[ 1870.585107][T21259] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1870.626793][T21259] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1870.656992][T21296] Unknown ioctl -1060612506
15:51:18 executing program 2:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x800, 0x0)
syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000040)={@fixed={[], 0x12}, 0xd5f})
syz_emit_ethernet(0xa6, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000980000000000739078ac1e0001ffffffff8626ffffffff061007ccd9a8847228dfc60f5f7aaab702038d000d81b15a89c0e23a8625af2c890b910a010100ac1e000100441cdd70000000070000000600006673000000000000001f0000000644149931e0000001ffffffffac1414bb00000adc831b59ac1414bbac14143eac1414aaffffffffac1e0001ffffffff00000003000000"], 0x0)

15:51:18 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000a466befd695d53ff070000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1870.699110][T21259] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1870.755718][T21259] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
15:51:18 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000040)=0x515f)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r2], 0x40}}, 0x0)
close(r2)

[ 1870.836310][T21283] ubi0: background thread "ubi_bgt0d" started, PID 21283
[ 1870.845920][T21265] ubi: mtd0 is already attached to ubi0
[ 1870.852215][T21289] ubi0: detaching mtd0
15:51:18 executing program 2:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x15b2c2, 0x0)
ioctl$SNDRV_PCM_IOCTL_RESET(r0, 0x4141, 0x0)
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

[ 1870.905826][T21289] ubi0: mtd0 is detached
15:51:18 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d000000000000e294000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c7104bde4bf17dc8f3259ec78e5b39515991b1428faabe601e2113661d11f08ac1f5c1bcf0f9b1a1bfb24a7e7d92c856f07aa3e9523cfda4d86fdfbfa352c863747a4764ae067f50e895c36877a76b538"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4})
fcntl$setsig(r4, 0xa, 0x17)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1871.294155][T21345] ubi0: attaching mtd0
[ 1871.299027][T21345] ubi0: scanning is finished
[ 1871.417306][T21345] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1871.438237][T21345] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1871.462802][T21345] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1871.487440][T21345] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1871.502479][T21345] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1871.509659][T21345] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1871.532571][T21345] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1871.546525][T21345] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1871.563670][T21348] ubi0: background thread "ubi_bgt0d" started, PID 21348
15:51:20 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000002c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000240)={0x0, 0x80000})
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:20 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000480)={&(0x7f0000000180)="2d6364a485fbd19c53bbb634fc053505d1b2767b22d7e5e373d9b2eeb61db06a4e4b6e19f9faacf4a77aa588d64a959bd3de8a2a9204590a87ceaa3a3cbae0649476b063a8c8bce1c13781f5b5704937f5842ead4e902e7be53dad6757aaf265cb8f03736a8d4f94117f61a7394149b2d936f47bd1ccda06a2b2f91921da41e463f171f5cf4b9d3528befa2d27a2b76b721ea1241d87", &(0x7f0000000240)=""/205, &(0x7f0000000040), &(0x7f00000003c0)="2e3d1eed070e4b812e293017e6d66e3cad1fdf25e610688716c5f92fdffd37a75365b65fc07916c1601772e1a02d40661324cbaf69724e066e6b17d7405c0b490c814436e290be870e737aad16423dc8d0a1f915a4d84e516915240773ed50c3e98bb52a938be2531a75a8c4f235da816dd2bd2c1dc6690a0443461009b6ae1c2663e83d1a37d2eb3cfea9befc8fee2a519b104b1b0a4d117c3b89032d572e006aabe9dfc14d492a9e", 0x8000, r1}, 0x38)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:20 executing program 2:
syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@canfd={0xd, {{}, 0x37, 0x0, 0x0, 0x0, "d7647955323993ec4eba4caacb939a7ccb0ef86cbf9915d60c9f8d4020a081326bff2f7afaca1434f9d1aae6abdf9b4b14e2e8977929b7beace6680de35cd053"}}}}, 0x0)
r0 = dup(0xffffffffffffffff)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @multicast2, @empty}, &(0x7f0000000080)=0xc)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00')
sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x30, r1, 0x20, 0x70bd28, 0x25dfdbfd, {{}, {}, {0x14, 0x18, {0x1000, @bearer=@udp='udp:syz2\x00'}}}, ["", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x44000}, 0x20000006)

15:51:20 executing program 0:
perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x30050, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffc}, 0x0, 0x0, 0x80, 0x6, 0x1f}, 0x0, 0x2, 0xffffffffffffffff, 0x8)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
prctl$PR_SET_TSC(0x1a, 0x2)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:51:20 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(0xffffffffffffffff, 0xc10c5541, &(0x7f00000002c0)={0xf2, 0x6})
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="4000000010003b0e7a00000000c9d21c5bb55759", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r2, @ANYBLOB="1800120008000100747070004b8ab1686323ea1643aae6341b72610c0002f408000100d0b926016bbcf10a9685ace6f9c514bdeef8e3f1425dd1d935686000292d7fbafdf6426e15ec5893972feb1b13815f4bfc753b87b8135e0c88cba9628f698947b42176be7683931d44519fdbdefcba8655a8a7a2a6f18a477a3372abb58d286bdf23c6a7a664314e000dcb774112e8d45ff34e3516c9aa302cc2346e6c372cb126feadb195cb33f810aceaedff413c15e6f57b4b2053ceaae12a5c00f37477e9bf91b184a5df197a5f05", @ANYRES32=r1], 0x40}}, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0xa081, 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/kvm\x00', 0x40e341, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f00000018c0)={0x4, <r7=>0xffffffffffffffff})
dup2(0xffffffffffffffff, r7)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000004c0)={<r8=>r4})
epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r8, &(0x7f0000000500)={0x7000000a})
ioctl$KDGKBDIACR(r3, 0x4b4a, &(0x7f00000001c0)=""/219)
r9 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r9, 0x40186f40, 0x76006e)
setsockopt$inet_sctp_SCTP_RECVRCVINFO(r9, 0x84, 0x20, &(0x7f00000000c0)=0x3, 0x4)
close(r1)

15:51:20 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d00000000000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fac37da978088b151143f0c34881331cbf5d7c58ea5a4491b7727e15a0db6b73aae3d13d0321b9a946639ce4d66ecbb178b994fcd3ff293a7c37cd15a55c2efa303a9531d511506f451c4638c1c3a325783cdc9f08122973111b04c0d591e30192a67326cb34942e3357627b16ca5c06a7b2fb41fe835050420700e3a79ddf8ff252ab1b2b85505d1f290b33dab9adc39aced53cffe18565a6af570d22274e0c00000000"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
sendto$l2tp6(r3, &(0x7f0000000240)="c0", 0x1, 0x20000840, 0x0, 0x0)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1872.897748][T21371] ubi0: detaching mtd0
15:51:20 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000180000000000739078ac420001ffffffff03000000"], 0x0)

[ 1872.922104][T21371] ubi0: mtd0 is detached
[ 1872.923207][T21368] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1872.961539][T21379] ubi0: attaching mtd0
[ 1872.999936][T21379] ubi0: scanning is finished
15:51:20 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000000)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:51:20 executing program 2:
r0 = gettid()
tkill(r0, 0x1004000000016)
ioprio_get$pid(0x0, r0)
syz_emit_ethernet(0x7c, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @igmp={{0x17, 0x4, 0x3, 0x1, 0x6e, 0xff, 0x0, 0x5, 0x2, 0x0, @remote, @private=0xa010100, {[@generic={0x44, 0x12, "21dcf5bc078fec78a0db6b58b39fa558"}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x32, 0x3, [{0x1, 0x8, "4125399da367"}, {0x6, 0x6, "ba4484e0"}, {0x5, 0xb, "81c4bdce23b4a2435a"}, {0x2, 0x7, "a6b64b8439"}, {0x0, 0x3, '!'}, {0x7, 0x3, "c1"}, {0x1, 0x6, "dfd6e5e8"}]}]}}, {0x17, 0x4, 0x0, @broadcast, "d62ecb36353c8aef316a"}}}}}, 0x0)

[ 1873.146096][T21379] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1873.164783][T21379] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1873.208679][T21379] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1873.225140][T21379] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1873.237854][T21379] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1873.303295][T21379] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1873.344045][T21379] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1873.389937][T21379] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1873.425372][T21390] ubi0: background thread "ubi_bgt0d" started, PID 21390
[ 1873.433655][T21369] ubi0: detaching mtd0
[ 1873.513710][T21369] ubi0: mtd0 is detached
[ 1873.530129][T21382] ubi0: attaching mtd0
[ 1873.536819][T21382] ubi0: scanning is finished
[ 1873.648887][T21382] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1873.665384][T21382] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1873.682061][T21382] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1873.698648][T21382] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1873.719182][T21382] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1873.733170][T21368] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1873.786474][T21382] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1873.829218][T21382] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1873.847670][T21382] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1873.858733][T21384] ubi: mtd0 is already attached to ubi0
[ 1873.859232][T21406] ubi0: background thread "ubi_bgt0d" started, PID 21406
[ 1873.873182][T21394] ubi0: detaching mtd0
[ 1873.897584][T21394] ubi0: mtd0 is detached
[ 1873.906391][T21392] ubi0: attaching mtd0
[ 1873.917174][T21392] ubi0: scanning is finished
15:51:21 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
write$nbd(0xffffffffffffffff, &(0x7f0000000180)={0x67446698, 0x0, 0x1, 0x0, 0x4, "53153a4e0245183343df734b50ec692cf1c23360f4082b0c745fac54f0db218522cd0840b03b354b8e61cce905b15469b956343e81cef492d476bdc1f7f2e65cf4893900717789081c9131375aff2303f48484c202c03fa9fc04f273f46d8df3070363ef23d78d592069b0fc49d6698869a21f9d086017bc086cb86a3fc7182d27b9aeb48bf5fd6fac8f3f2ee7ca8002085f2e300a571f77d426683e07cc1ace1346976e434035b374c9dceb9c5deed4d95aba13b8ce"}, 0xc6)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:21 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f00000018c0)={0x4, <r8=>0xffffffffffffffff})
dup2(r5, r8)
r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r11, 0xc00caee0, &(0x7f00000018c0)={0x4, <r12=>0xffffffffffffffff})
dup2(r9, r12)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x36, 0x0, 0x0)
r13 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRESDEC, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYBLOB="d1e4ae0bc0d08cd723facbfc3f8c4f70a3f03cf4200e2c46a79a7c97defa9a0b0e3885f95586ce8835116cc10c830d6e20d590292b37b4b91f52ca65246e1ecaadb8c48d295dc514d4673071874ac95be611b5657fef43ba41c2725f6a2932aff15edd0446062ca5d0b16799ac7fc302e199af6290726963e4140577c993", @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r13], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
close(r13)

[ 1874.056440][T21392] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:51:21 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x1, 0x8, 0x6, {0x1, 0x7fffffff}, 0x0, 0xfd})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1874.130376][T21419] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1874.231889][T21431] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1874.524721][T21404] ubi0: attaching mtd0
[ 1874.576575][T21404] ubi0: scanning is finished
[ 1875.194975][T21404] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1875.222530][T21404] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1875.240809][T21404] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1875.247979][T21404] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1875.263479][T21404] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1875.277519][T21404] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
15:51:22 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
write$nbd(0xffffffffffffffff, &(0x7f0000000180)={0x67446698, 0x0, 0x1, 0x0, 0x4, "53153a4e0245183343df734b50ec692cf1c23360f4082b0c745fac54f0db218522cd0840b03b354b8e61cce905b15469b956343e81cef492d476bdc1f7f2e65cf4893900717789081c9131375aff2303f48484c202c03fa9fc04f273f46d8df3070363ef23d78d592069b0fc49d6698869a21f9d086017bc086cb86a3fc7182d27b9aeb48bf5fd6fac8f3f2ee7ca8002085f2e300a571f77d426683e07cc1ace1346976e434035b374c9dceb9c5deed4d95aba13b8ce"}, 0xc6)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:22 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000240), 0x1}}, 0x0, 0xffffefffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae635ffff7f0000cde5c019080096e2c43f6b8fd41b7eaf40ced1b67510cfd4f6b0ccb087927666ada01528b7185a46ab73d709f520aa8672b76f0150592b48588a84f8347a1b5ecddadbf0459b62fe99fa751143a6fd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c756a8eebce6a6b320f50e3107b3acbbb57e12d0600b9e5362f9a78d7516f8f25bfc91c15d7dc2adcdefba08692070000000000000079379829652b10737d4e25a22695dff4fc990000059fff70b24f8228bd07741c71fbbce4bf17dc8f3259ec78e5b39515991b1428fa175a0478b28164c1c2a338df23879a8b8bb821a786fd8802ad33cdef0000000000"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r3 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r3, 0x0, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, &(0x7f00000002c0), 0xfffffcaa)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:22 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="000000000008000008000a00ebe2fb5cfd067ef12f3df768515cb97c48a090b9d81a7b9de2cd50a3", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:22 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:22 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = syz_open_procfs(0x0, 0x0)
ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
getdents64(r2, &(0x7f0000000180)=""/165, 0xa5)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1875.289634][T21404] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1875.303460][T21404] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1875.317361][T21458] ubi0: background thread "ubi_bgt0d" started, PID 21458
[ 1875.328757][T21400] ubi: mtd0 is already attached to ubi0
[ 1875.408008][T21465] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1875.428712][T21467] ubi0: detaching mtd0
[ 1875.465927][T21467] ubi0: mtd0 is detached
[ 1875.471663][T21469] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1875.605833][T21475] ubi0: attaching mtd0
15:51:22 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x28bd, 0x42, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x4, 0xf0, 0x40, [{{0x9, 0x4, 0x0, 0x3f, 0x2, 0x3, 0x1, 0x1, 0x5, {0x9, 0x21, 0xf8, 0x0, 0x1, {0x22, 0x291}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x1, 0xff, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x8, 0x80, 0x6}}]}}}]}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x200, 0x40, 0x4, 0x5, 0x40, 0x1}, 0xf, &(0x7f00000001c0)={0x5, 0xf, 0xf, 0x2, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0xa, 0x9, 0x1}]}, 0x1, [{0xd6, &(0x7f0000000200)=@string={0xd6, 0x3, "4b995c478fabd2dad165eb91d97c2f74f07fac64aea43ab615a7ddac05470b7d23003df76c48796e535d647f9bd1d2a917843346a3723a39fa3f51d945b5a08338a479e4c74b0f9ead88a5e99e9d606ed04c83a9e9ea1a61de74f3413e9b9f168408d51f1be2b480195bf7f73a646fae763ef20a754b2e0107eacf57918d234e0f051ac502794fe2da3c9028387dded3d1dac78687a3940b4735069be187f767c641aa5826751d01510595acd15445eec5136406e2b470649f38cbd42d318c7742ef48eaaaaff0066963b8a1268d36985c539cec"}}]})
syz_usb_control_io$hid(r1, &(0x7f0000000540)={0x24, &(0x7f00000003c0)={0x40, 0x30, 0x7e, {0x7e, 0xf, "6c0acc10d1a61e41454eb58a067bb01fb35500e42867d357f82511fbf14570a9190d6cf248e38c379a40cf4ea1bb76c0b529fa493a12fa1784fb8fbe92f2fc1de87aebc81ca688f0e4686bf8da98b18001489e24cdec1568d13337fc54923da5d8ca47ad0e8827704a6f1fa38227b8309427e6a4efbf481f35ab7d0c"}}, &(0x7f0000000480)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44b}}, &(0x7f00000004c0)={0x0, 0x22, 0xb, {[@local=@item_4={0x3, 0x2, 0x2, "2917eaf9"}, @global=@item_4={0x3, 0x1, 0x4, "7eeb86c7"}, @global=@item_012={0x0, 0x1, 0xb}]}}, &(0x7f0000000500)={0x0, 0x21, 0x9, {0x9, 0x21, 0x6, 0x81, 0x1, {0x22, 0x759}}}}, &(0x7f0000000800)={0x2c, &(0x7f0000000580)={0x20, 0x14, 0x9b, "b7f30eccbacd7558d42463b464ace969d9641597741b7172e61cb02873ba21270a615c7cdb3ff1b773374771f953b229ea2e0df5e46e1fa6df8db974f77258ee5ac7d972a4327b86927f4975261116153be65bb2eff965387d6946ca594c5e5498fd58b38b79726ca0c4ff8974a97ce79dbe2470eae837813789979dc554b6a49406377bf9519eddfc3c2f5c9f2b283760a1003ce60644895b43a6"}, &(0x7f0000000640)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000680)={0x0, 0x8, 0x1, 0x2}, &(0x7f00000006c0)={0x20, 0x1, 0xe5, "2055135b669bfa173b9dbf95097beb11d38a0a658dd235c93b7794252a297157fb107966bc429fd988d0248523d0d5307191584c2a6e5497d1af80216bb13129397ebe4293868855b4596b5c15727a923a0be992fa71e35556f416781ae6533c42878e8149cb03c353932550c2a29474b6d8e3cec0a4e0a43ed3c40db30e7be8324ab1305e8a78b99884ab8be15ab7b9ec87294b35e4db62670ce0c7bf35a62e8321c4bb2d79f4cfe1be4138e5dcd4ac079d4bc72ba6c2e6902b4977025e6c1a32d9ab6a92183282c989d0f67ac15c1650b505f3d8611d0e2af5bccc3d8424388e5877b97f"}, &(0x7f00000007c0)={0x20, 0x3, 0x1, 0x8}})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1875.658356][T21475] ubi0: scanning is finished
15:51:23 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e)
r4 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
r5 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r6=>0x0}, &(0x7f0000000040)=0x8)
r7 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r7, 0x0, 0x0)
ioctl$UI_SET_PROPBIT(r7, 0x4004556e, 0x1a)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r6}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000040)={r6, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp6_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=r6, &(0x7f0000000100)=0x4)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYRES64=r2, @ANYRES32=0x0, @ANYRESHEX, @ANYRES32, @ANYBLOB="18001200080001007070700022b12d29c0eedb4ae5fb959ceee299097a2909f9e778424eda4f8149f00283fbb622db3f4975a4e59639ef11aabb792cff6fa927f59070346874f23d0c2fa0e9a2581186037a1fa4b7ec87dd4f00ed60b81eff63a45998ce157a82caca6011e466ff81b2b6abd0897f9375e670a5aedc3241436314ec9c771ec2242cd6fe44d41fe4ba221372a65adf88067f100ec83013e3f811170e6f0208821e076fba7991525f10040b89669246afd82dae0f3c1ec15c443ed0ca426999e4a1d5395203b96f15b2455a5e910c540fb974aeb0ae1041d9bdfa35810daaa3bf771a1ca45d0ef37970472b2c03bbee1957451d8fa892", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x20004080}, 0x0)
close(r1)

[ 1875.796715][T21475] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1875.808773][T21475] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1875.819982][T21475] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1875.838177][T21475] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1875.856685][T21475] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1875.866943][T21475] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1875.880455][T21475] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1875.897773][T21475] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1875.908758][T21486] ubi0: background thread "ubi_bgt0d" started, PID 21486
[ 1875.920640][T21466] ubi0: detaching mtd0
15:51:23 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000002c0)={&(0x7f00000001c0)=[0x4, 0xffff, 0x514, 0x3, 0x7fff, 0x9, 0x3a], 0x7, 0x0, 0x7fff, 0x3, 0x8, 0x100, 0x80000000, {0x101, 0x6a, 0x7ff, 0x9f, 0x3, 0x1, 0x9, 0x9, 0x6, 0x7, 0x8c, 0xff81, 0x48, 0x3, "b90b130a06de5be7a8a2cd950290953b78420e8d9f724c0d64679693b89559e7"}})
creat(&(0x7f0000000000)='./file0\x00', 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, 0xffffffffffffffff)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x10010, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1875.995694][T21466] ubi0: mtd0 is detached
[ 1876.130552][ T7635] usb 6-1: new full-speed USB device number 3 using dummy_hcd
15:51:23 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
ioctl$RTC_EPOCH_READ(r0, 0x8008700d, &(0x7f0000000000))
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x5)

15:51:23 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000008018f6adf378a249ed74bda", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:23 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(0xffffffffffffffff, r3)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f00000018c0)={0x4})
r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f00000018c0)={0x4, <r9=>0xffffffffffffffff})
dup2(r6, r9)
ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x5, 0x9, 0x5, 0x0, 0x0, [{{}, 0x8}, {{}, 0x29}, {{}, 0x40}, {{r5}, 0xa}, {{r6}, 0xa1}]})
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

[ 1876.288984][T21503] ubi0: attaching mtd0
[ 1876.301392][T21503] ubi0: scanning is finished
[ 1876.374961][T21510] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1876.439144][T21513] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1876.453369][T21503] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1876.486910][T21503] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1876.511354][ T7635] usb 6-1: config 1 interface 0 has no altsetting 0
[ 1876.528833][T21503] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
15:51:23 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)

[ 1876.574875][T21503] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1876.636891][T21503] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1876.671142][ T7635] usb 6-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.40
[ 1876.681484][T21503] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1876.696418][ T7635] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1876.701301][T21503] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1876.736076][ T7635] usb 6-1: Product: syz
[ 1876.749149][T21503] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1876.758557][ T7635] usb 6-1: Manufacturer: syz
[ 1876.782231][ T7635] usb 6-1: SerialNumber: syz
[ 1876.792844][T21515] ubi0: background thread "ubi_bgt0d" started, PID 21515
[ 1876.801704][T21528] ubi: mtd0 is already attached to ubi0
[ 1877.068167][T21543] ubi0: detaching mtd0
[ 1877.167806][T21543] ubi0: mtd0 is detached
15:51:24 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000002c0)={&(0x7f00000001c0)=[0x4, 0xffff, 0x514, 0x3, 0x7fff, 0x9, 0x3a], 0x7, 0x0, 0x7fff, 0x3, 0x8, 0x100, 0x80000000, {0x101, 0x6a, 0x7ff, 0x9f, 0x3, 0x1, 0x9, 0x9, 0x6, 0x7, 0x8c, 0xff81, 0x48, 0x3, "b90b130a06de5be7a8a2cd950290953b78420e8d9f724c0d64679693b89559e7"}})
creat(&(0x7f0000000000)='./file0\x00', 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, 0xffffffffffffffff)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x10010, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:24 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYRESHEX=r1, @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:24 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x5080}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000000)={0x0, 0x6, 0x0, {0x0, 0x7ffffffc}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)

15:51:24 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
pipe(&(0x7f00000002c0)={<r3=>0xffffffffffffffff})
ioctl$VIDIOC_G_CROP(r3, 0xc014563b, &(0x7f0000000300)={0x7, {0xfffffff9, 0x2, 0x40000, 0x5}})
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000240)=0x1)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r4, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r5, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:24 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000180000000000739078ac1e0001d239d9b203000000"], 0x0)
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x145102, 0x0)
ioctl$BLKDISCARD(r3, 0x1277, &(0x7f0000000080)=0x3)

[ 1877.313619][T21555] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1877.398674][T21558] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1877.478435][T21560] ubi0: attaching mtd0
[ 1877.524399][T21560] ubi0: scanning is finished
[ 1877.720470][ T7635] usbhid 6-1:1.0: can't add hid device: -71
[ 1877.726595][ T7635] usbhid: probe of 6-1:1.0 failed with error -71
[ 1877.746301][T21560] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1877.754097][T21560] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1877.763138][T21560] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1877.774632][T21560] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1877.774874][ T7635] usb 6-1: USB disconnect, device number 3
[ 1877.788543][T21560] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1877.796495][T21560] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1877.805830][T21560] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1877.817417][T21560] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1877.829537][T21566] ubi0: background thread "ubi_bgt0d" started, PID 21566
[ 1878.259368][T21580] ubi0: detaching mtd0
[ 1878.314640][T21580] ubi0: mtd0 is detached
[ 1878.361384][ T7635] usb 6-1: new full-speed USB device number 4 using dummy_hcd
15:51:25 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x800000000000}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$VIDIOC_S_AUDIO(r0, 0x40345622, &(0x7f0000000040)={0x6f5, "c9add13e242782eeb7c1f6dd6de3d006833979af29a411b07c63cab93895529b", 0x1, 0x1})
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ttyS3\x00', 0x280480, 0x0)
ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f00000001c0))
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:25 executing program 4:
prctl$PR_GET_FPEXC(0xb, &(0x7f0000000040))
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f00000000c0), &(0x7f0000000140)=0x4)
close(r1)

15:51:25 executing program 2:
lsetxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2)
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x3, 0x18, 0xfffd, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

15:51:25 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff, 0x1})
dup2(r1, r4)
ftruncate(r1, 0x1000)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3805003c0005ce0000", @ANYRES32=r6, @ANYRESHEX], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r6, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="94000000", @ANYRES16=0x0, @ANYBLOB="000425bd7000fcdbdf416adce087b725030000000800030005000000080003000300000008000200060000002c000147ebbf608006000100000000000800060001000000060805004e24", @ANYRES32=0x0, @ANYBLOB="08000600000000000800030004000000080003000600000008000300010000000800020000000000080003000000000014000180080006000400000008000700", @ANYRES32=0x0, @ANYBLOB], 0x94}, 0x1, 0x0, 0x0, 0x11}, 0x4000)

15:51:25 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0xa482, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={&(0x7f0000000300)}, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x8, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588b84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x103240, 0x0)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, &(0x7f00000002c0)={0x1, 0x9, 0x2})
ioctl$NBD_CLEAR_SOCK(r1, 0xab04)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:26 executing program 2:
syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @link_local, @val={@void, {0x8100, 0x3, 0x1, 0x3}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x1, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}}, "03000000"}}}}, 0x0)

[ 1878.751973][T21599] ubi0: attaching mtd0
[ 1878.766122][T21599] ubi0: scanning is finished
15:51:26 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYRES32=r2, @ANYRES32=0x0, @ANYBLOB="000000000000e4ff07000a00", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

[ 1879.006042][T21599] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1879.038005][T21599] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1879.146485][T21599] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1879.166242][T21599] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1879.367475][T21599] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1879.376627][T21599] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1879.392360][T21599] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1879.407483][T21599] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1879.420626][T21624] ubi0: background thread "ubi_bgt0d" started, PID 21624
[ 1879.427836][T21614] ubi0: detaching mtd0
[ 1879.436309][T21614] ubi0: mtd0 is detached
15:51:27 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0xa482, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={&(0x7f0000000300)}, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x8, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588b84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x103240, 0x0)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, &(0x7f00000002c0)={0x1, 0x9, 0x2})
ioctl$NBD_CLEAR_SOCK(r1, 0xab04)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:27 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000000)=ANY=[@ANYRES64], 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
getpeername$ax25(r0, &(0x7f0000000040)={{0x3, @netrom}, [@null, @null, @null, @default, @null, @null, @rose]}, &(0x7f00000000c0)=0x48)

15:51:27 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000140)={0x7, &(0x7f0000000080)=[{0xfff, 0x1f, 0x0, 0x9}, {0x0, 0x9, 0x0, 0x8}, {0x4, 0x9, 0x1, 0x8}, {0x5, 0x1, 0xfa}, {0x2, 0x56, 0x7f, 0x3a9043a3}, {0x3, 0x80, 0x1, 0x2}, {0x3, 0xc7, 0x1, 0x40}]})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
r6 = dup2(r2, r5)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r6, @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYRES32=r2, @ANYRESHEX=r5], 0x40}}, 0x0)
close(r1)

15:51:27 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff, 0x1})
dup2(r1, r4)
ftruncate(r1, 0x1000)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3805003c0005ce0000", @ANYRES32=r6, @ANYRESHEX], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r6, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="94000000", @ANYRES16=0x0, @ANYBLOB="000425bd7000fcdbdf416adce087b725030000000800030005000000080003000300000008000200060000002c000147ebbf608006000100000000000800060001000000060805004e24", @ANYRES32=0x0, @ANYBLOB="08000600000000000800030004000000080003000600000008000300010000000800020000000000080003000000000014000180080006000400000008000700", @ANYRES32=0x0, @ANYBLOB], 0x94}, 0x1, 0x0, 0x0, 0x11}, 0x4000)

15:51:27 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
newfstatat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0), 0x4000)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:27 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffc000/0x2000)=nil, 0x2000})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
ioctl$BLKALIGNOFF(r2, 0x127a, &(0x7f0000000180))
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:27 executing program 2:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x8000, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r3}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000040)={r3, 0xfffffffe}, &(0x7f0000000080)=0x8)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={r3, 0x9}, 0x8)
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

[ 1880.159004][T21663] ubi0: attaching mtd0
15:51:27 executing program 4:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00'/12, @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r5], 0x40}}, 0x0)
close(r5)

[ 1880.211324][T21663] ubi0: scanning is finished
[ 1880.387757][T21663] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
15:51:27 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff, 0x1})
dup2(r1, r4)
ftruncate(r1, 0x1000)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3805003c0005ce0000", @ANYRES32=r6, @ANYRESHEX], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r6, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="94000000", @ANYRES16=0x0, @ANYBLOB="000425bd7000fcdbdf416adce087b725030000000800030005000000080003000300000008000200060000002c000147ebbf608006000100000000000800060001000000060805004e24", @ANYRES32=0x0, @ANYBLOB="08000600000000000800030004000000080003000600000008000300010000000800020000000000080003000000000014000180080006000400000008000700", @ANYRES32=0x0, @ANYBLOB], 0x94}, 0x1, 0x0, 0x0, 0x11}, 0x4000)

[ 1880.428127][T21675] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1880.457662][T21663] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
15:51:27 executing program 4:
socket$nl_route(0x10, 0x3, 0x0)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x200800, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r2 = openat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)={0x40040, 0x10, 0xa}, 0x18)
write$P9_RATTACH(r2, &(0x7f00000001c0)={0x14, 0x69, 0x1, {0x80, 0x1, 0x2}}, 0x14)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYRESHEX=r1, @ANYRES32, @ANYBLOB="1800080001e86f037070000c00920008000100ea625c19414dee9b00", @ANYRES32=r0], 0x40}, 0x1, 0x0, 0x0, 0x44010}, 0x0)
close(r0)

[ 1880.500902][T21663] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1880.522460][T21675] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1880.542205][T21663] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1880.585367][T21663] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1880.606718][T21663] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1880.622393][T21663] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1880.642989][T21663] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1880.680408][T21668] ubi0: detaching mtd0
[ 1880.680506][T21674] ubi0: background thread "ubi_bgt0d" started, PID 21674
[ 1880.728175][T21668] ubi0: mtd0 is detached
15:51:28 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x0, {0x0, 0x7fffffff}, 0x0, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
syz_open_procfs(0x0, 0x0)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff, 0x1})
dup2(r1, r4)
ftruncate(r1, 0x1000)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3805003c0005ce0000", @ANYRES32=r6, @ANYRESHEX], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r6, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="94000000", @ANYRES16=0x0, @ANYBLOB="000425bd7000fcdbdf416adce087b725030000000800030005000000080003000300000008000200060000002c000147ebbf608006000100000000000800060001000000060805004e24", @ANYRES32=0x0, @ANYBLOB="08000600000000000800030004000000080003000600000008000300010000000800020000000000080003000000000014000180080006000400000008000700", @ANYRES32=0x0, @ANYBLOB], 0x94}, 0x1, 0x0, 0x0, 0x11}, 0x4000)

15:51:28 executing program 4:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0xa732})
r3 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}})
write$tun(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000ffffffffffff71ffc5b8ebb186dd605f3f1b00081155c01107c87de684eaaca8705e282fd081ffb8fed5fba5b8637ba34397ebd602c43ddfc69cb0242a"], 0x42)
splice(r0, 0x0, r2, 0x0, 0x18100, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r5], 0x40}}, 0x0)
close(r5)

[ 1881.929679][T21738] ubi0: attaching mtd0
[ 1881.936080][T21738] ubi0: scanning is finished
15:51:30 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0xa482, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={&(0x7f0000000300)}, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x8, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588b84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x103240, 0x0)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, &(0x7f00000002c0)={0x1, 0x9, 0x2})
ioctl$NBD_CLEAR_SOCK(r1, 0xab04)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:30 executing program 2:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000)=0x1f, &(0x7f0000000080)=0x1)
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

15:51:30 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000040)={0x3, 0x0, [0x0, 0x0, 0x0]})
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x9, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
dup(r2)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:30 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400}, 0x5540, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
getsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000300)={@rand_addr, @rand_addr, @loopback}, &(0x7f0000000500)=0xc)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
restart_syscall()
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$PPPIOCATTACH(r2, 0x4004743d, &(0x7f0000000240)=0x3)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
write$rfkill(0xffffffffffffffff, &(0x7f00000002c0)={0x80, 0x2, 0x1, 0x0, 0x1}, 0x8)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1882.692594][T21738] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:51:30 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0xa482, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={&(0x7f0000000300)}, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x8, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588b84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x103240, 0x0)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, &(0x7f00000002c0)={0x1, 0x9, 0x2})
ioctl$NBD_CLEAR_SOCK(r1, 0xab04)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:30 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0)
ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="4e6aff801a819f13180012000800010070707000", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)
ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x9, 0x7b95, 0x0, 0x9, 0x17, 0x9, "cda81262f493eae6cfc2e290a1c723fd7fbf9b0b80a419ee49c391a0f362e1e18bf6c7c84eb2664a6eccbf43d628aa3841620480f063383686b7a710107194f8", "40cb624fbf4cea44203b0112fc0005858eafd5f29958f6ba39cdf746f08bbb04a74b86943954732ba5ce126b8d1af3078d546af22adafaefe2fda6cbdc6f59ba", "5f8b982fbb6016826544bad6835d1f416b09750cce467cdd7fa8200b90cdd6d2", [0x43, 0xc7cd]})
r3 = openat2(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x200200, 0x81, 0x8}, 0x18)
setsockopt$inet_tcp_buf(r3, 0x6, 0x21, &(0x7f0000000300)="1a465cb1a3da482d0b3f4623d33141554d6aa96b894f3464a44b8a727fbd836bf67e222b82fccbfe1513cd5847b43c9288831a706cbb67cc44da542e7b177b3b10609cb7e2e9b0d7536f1c71090125fa3294105446fa33968b3c106915cf58b030cbd72d29a2bfeaf1ac6ace0222f57452fa36c355dcbed661a0262e0958211d209ce52d688d7ba0801a46f3d71f244965f4e6a57ec2487c6b8a36635aca648535d9e9a7998d8a928d2eea60d76e6767a7936d7c5ee6f94c21801f79027a624d077930670ca5c2ac86af135a5f814406faac1d6b", 0xd4)
write$P9_RCLUNK(r3, &(0x7f00000001c0)={0x7, 0x79, 0x2}, 0x7)

[ 1882.844362][T21754] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1882.933090][T21755] ubi0: attaching mtd0
[ 1882.938226][T21755] ubi0: scanning is finished
[ 1882.962879][T21757] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
15:51:30 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @rand_addr=0x64010101, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$FITRIM(r0, 0xc0185879, &(0x7f00000000c0)={0x7, 0x25be, 0x4})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00')
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, r2, 0x1ad}, 0x14}}, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
sendmsg$IPVS_CMD_NEW_DEST(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="080000000ecdc14ff9e7ccbc1b210c320d76c37b019729ba688ad79b6bb46aea4cbef50baa76112f09c95fdbd6d45551957d163cd7be2a4e35f4acc1f33d6a1e39f935a53a2090ebb9ac6640d492802e0b1637", @ANYRESOCT=r1, @ANYBLOB="000229bd7000fcdbdf250500000008000600c1ffffff0800060005000000680003801400060000000000000000000000ffff64010102060007004e240000080003000200000008000100010000000500080003000000060007004e24000014000600fe8000000000000000000000000000aa1400020073797a6b616c6c65723000000000000008000400000000000800060003000000080004000300000040000380060007004e24000014000600ff0100000000000000000000000000d8cb3ab6f62f982a00f9869701060007004e2100000600040002000000080001000200000008000100000000000c0002800800050007000000"], 0xf0}, 0x1, 0x0, 0x0, 0x80805}, 0x20004840)

15:51:30 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040))
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="000000010000000008fb09006e1d2506cf4cb0ae7808ef5de6e6ff7b0201673d028c7507b6eb4dafb7fe9c366fd34fa941cdac0dbda49f94a4173e2e94f48e4ec1ef34b0eacafb2efbbb7dea5d8270d6dc6f19d464a80e6c41107822e556a06545b92b3d7ac78608d852ee1cabb84fb7428266a771a8ed94f3865cd7e72c68d04c8543ddb47781a9b4e03f70687699a2fdc88ab01cf7ae70246a02040ffa3f1b2eff8013cf50c49071ef7095730ccf4fe0eab23b317654ac7bd82850c9eda50e8874e895306234b683152c8ca61eae858a33898b9efbc3fbd512a5f788d482a3ff3d29a20a7366e9289a26d293aee6a6c20a7c2fe0a329dc990c11a103237a65735a5ee681293123f8652a7e7551925fdbdd12e0db85ceb8a83d766fb46c83809da846a791be94c5fc036482621901b2c2eacd0f0b318e59bb6e1989efd08a730c2ab9e2e0b7a97a4060cf54f1cea61cf51bb2d81c1aa5d727a0f48d4731dcecb1d8d6964d50363f902ab55b21", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r2], 0x40}}, 0x4004)
close(r1)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r7 = dup2(r6, r1)
recvfrom$inet(r7, &(0x7f00000001c0)=""/115, 0x73, 0x40000100, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10)
socket$inet_sctp(0x2, 0x1, 0x84)

[ 1883.169372][T21755] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1883.196647][T21755] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1883.235936][T21755] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
15:51:30 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0xff, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, "03000000"}}}}, 0x0)

[ 1883.286123][T21755] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1883.310987][T21781] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1883.324322][T21755] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1883.353604][T21755] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1883.391758][T21755] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1883.429573][T21792] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1883.432481][T21755] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
15:51:30 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @dev={[], 0x30}, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0xc, 0x0, @initdev={0xac, 0x1e, 0x5, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

[ 1883.473105][T21767] ubi0: background thread "ubi_bgt0d" started, PID 21767
[ 1883.481247][T21759] ubi0: detaching mtd0
[ 1883.512289][T21759] ubi0: mtd0 is detached
[ 1883.532068][T21758] ubi0: attaching mtd0
[ 1883.558671][T21758] ubi0: scanning is finished
15:51:30 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000e5bfdde121", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:30 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000002c0)={&(0x7f00000001c0)=[0x4, 0xffff, 0x514, 0x3, 0x7fff, 0x9, 0x3a], 0x7, 0x0, 0x7fff, 0x3, 0x8, 0x100, 0x80000000, {0x101, 0x6a, 0x7ff, 0x9f, 0x3, 0x1, 0x9, 0x9, 0x6, 0x7, 0x8c, 0xff81, 0x48, 0x3, "b90b130a06de5be7a8a2cd950290953b78420e8d9f724c0d64679693b89559e7"}})
creat(&(0x7f0000000000)='./file0\x00', 0x0)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40046f41, 0x76006e)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, 0xffffffffffffffff)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x10010, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1883.704312][T21758] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1883.763178][T21814] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1883.818186][T21816] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1883.966569][T21813] ubi0: attaching mtd0
[ 1884.019908][T21813] ubi0: scanning is finished
[ 1884.170739][T21813] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1884.178499][T21813] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1884.194650][T21813] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1884.204717][T21813] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1884.217370][T21813] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1884.227454][T21813] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1884.246921][T21813] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1884.266380][T21813] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1884.279840][T21822] ubi0: background thread "ubi_bgt0d" started, PID 21822
[ 1884.308211][T21826] ubi0: detaching mtd0
[ 1884.510904][T21826] ubi0: mtd0 is detached
15:51:32 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = semget$private(0x0, 0x207, 0x0)
semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000100))
semctl$GETNCNT(r1, 0x1, 0xe, &(0x7f00000003c0)=""/4096)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:32 executing program 2:
syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000008004500e4180000000000739078ac1e0001ffffffff0300000080ccbcc7d5d3c6e09d3e5217eabe003613d0d3a2f14724471b887c8df728939d51f1e30934e9254ef01845fbb482d8caa42fddbaa74b7f3b9aaa35f9d600fafbbf2289bcbea4a61b9e9a29"], 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x80000)
ioctl$MON_IOCH_MFLUSH(r0, 0x9208, 0x3)
prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1)

15:51:32 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428faab550140a237da193437ad25b9d3144d74f5922d5e72b6d3739b1a2dc6f5e488be7477e5a5941b627841b2faf7d00e7ed98a2df63718d8e6d5ef55e9b960a955dd672000970fac3b3c275a128845a456b002b09382e3eba10e2f10c44600c6da1a24d693387aeb4432f336b9bed78acc75267e99adc788ea3f1ff13352a7072deb0143acb1f349d969d6d25ec0aaf1af38772833139fe55ca47966cc603ba1e85fb311fcde797bf17375900f45dd1aa9602d469ccea05b7864e81270518d14f0f0aa7dd7d79d99735bc233f33119483c959c34f043"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:32 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@private, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in6=@dev}, 0x0, @in=@empty}}, &(0x7f0000000180)=0xc9)
setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000280)={@private2={0xfc, 0x2, [], 0x1}, r6}, 0x14)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0x0, 0x10080)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:32 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b00000000c2933acdb0c2104deea5c132b25a9dd7f7005a54f8", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008584364a839a4dd4c8849b1ec08223f000100", @ANYRES32=r1], 0x40}}, 0x0)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r5=>0xffffffffffffffff})
dup2(r2, r5)
getsockopt$IPT_SO_GET_REVISION_MATCH(r2, 0x0, 0x42, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f00000000c0)=0x1e)
close(r1)

15:51:32 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = semget$private(0x0, 0x207, 0x0)
semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000100))
semctl$GETNCNT(r1, 0x1, 0xe, &(0x7f00000003c0)=""/4096)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1885.126031][T21846] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:51:32 executing program 2:
syz_emit_ethernet(0x141, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x32, 0x4, 0x0, 0x6, 0x133, 0x67, 0x0, 0x5, 0x67, 0x0, @dev={0xac, 0x14, 0x14, 0x3d}, @private=0xa010100, {[@generic={0x82, 0xf, "840a2f423262f8ae16c9c2654d"}, @timestamp={0x44, 0x14, 0x2f, 0x0, 0x1, [0x401, 0x1f, 0x4, 0xff]}, @noop, @lsrr={0x83, 0x7, 0x3c, [@loopback]}, @timestamp_addr={0x44, 0x24, 0xdc, 0x1, 0xf, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2}, {@multicast1, 0x5}, {@multicast2, 0x81b}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}]}, @ssrr={0x89, 0x1f, 0xb1, [@remote, @multicast2, @private=0xa010102, @multicast2, @private=0xa010100, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x44}]}, @ssrr={0x89, 0x23, 0xe4, [@empty, @rand_addr=0x64010102, @multicast2, @broadcast, @rand_addr=0x64010102, @loopback, @rand_addr=0x64010100, @loopback]}, @ra={0x94, 0x4}, @timestamp={0x44, 0x10, 0xd5, 0x0, 0x4, [0x270, 0x10001, 0xfffffffa]}, @rr={0x7, 0xf, 0x5e, [@multicast1, @multicast1, @rand_addr=0x64010100]}]}}, "8d33df14c22aab60b1fa58c44db7f140f44194945bab2eae7dbfcbffa3b4e4f0abe58ae6966a81c36651b69e602f53dc76a86b575dd4a9598af9fd8d2edce7ed909233564c15ee62ef16996683aae8cf0bb86a869b8052ee9d4ad57bd4c168dd9eefb4c53877a356b5a7c0"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
sendmsg$nl_generic(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f0000000040)={0x28, 0x12, 0x200, 0x70bd2d, 0x25dfdbff, {0x1b}, [@typed={0x8, 0x60, 0x0, 0x0, @ipv4=@multicast2}, @typed={0xc, 0x15, 0x0, 0x0, @u64=0x8}]}, 0x28}}, 0x4000080)

[ 1885.292562][T21854] ubi0: attaching mtd0
[ 1885.318386][T21854] ubi0: scanning is finished
[ 1885.370400][T21849] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
15:51:32 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a0000000000050000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)

15:51:32 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0xa020, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)="41b8a41333e9936806803241260aefcabc78457bd1f9dddbc441320734148dd0214c7a784b250c2881cd7583bf48b0f8708e", 0x32}, {&(0x7f0000000180)="2303829e72e14085b900ab25538ba3b297f65abf06405d634c46e2da8a66333268f16fab6afe6e55c66d3f2410395568c3e52f1395a4ee800f06792ae40faad4997776dfa371a5e1c1febad37f8aab9d00e9fbe505edbf3173ac36c655e1e054b6860434a49b720f0d677887532b45bf7cd41d0ffe96c686aced1d02366d2542ce4ac4e141d12debe6a92ce0e9e7b914c93a549372fa", 0x96}, {&(0x7f0000000240)="fe65b195ebdebb36baa65081b8915f7fe52849aa079c6bd8ea40a035f88d50db72afd6877e8db5ef7615492fe8f74133568ad51186367aa78b859d9f9bb70c0a64a931177b9819c0674c3ad7565692393074b6d6a02b35ab1c87608e1a797af2317ae06618a6d521b0ef3a98697c9376c27c3c9f8165593b7a7bab6f8e1249220faa46c901a1a4391b310683a26fc56d81cd700121e5a1f2ad16292c199eda5fee32635eee499081aaa1491ec2ee239cdc360932f24f8786ee0239e6d0fcb9635e76203ec33c9b71553cc4078eab73292751c9b2b8c6cf7a369364bb393f00b8c0bf9940fd658ce201eb4a0a037521be0c90048758ab86fab32c2209af", 0xfd}], 0x3, &(0x7f0000000400)=[@op={0x18}], 0x18, 0x40804}, 0x8080091)

15:51:32 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = open$dir(&(0x7f0000000040)='./file0\x00', 0x440400, 0x20)
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000180)={0xa0002010})
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1885.593783][T21854] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1885.625657][T21854] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1885.663131][T21854] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1885.698124][T21854] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1885.729203][T21854] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1885.751038][T21854] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1885.814733][T21854] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1885.855475][T21854] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1885.878570][T21871] ubi0: background thread "ubi_bgt0d" started, PID 21871
[ 1885.895379][T21879] ubi0: detaching mtd0
15:51:33 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="400000001000220e7a0111000000000000000000ac4ddb3c2786aca56c8d4dabafdb20db4c2bc8a4b6e890766ab04754365e27bfe0d4f00f282da0a084000000000000003b92aa2c8c714cbb0000000000000000001032ecde455bdb0bb3c650d2268e45f89431cb6a8944a25fe2dbaeb13df63130f0a439a7e957c92c2b2310acca62b33fe8afcce82fbcec2c802eb727b8ba00f048b7fb2cde73fbbb210300be969aaab57efd8f4b636241177b5738719cf68fcdfe9bd0695dcc48b95f8bb05b183a133f50ce69b6834acd4ccc559e2353c2e8f2a530206edc673d52e1f6bdc8091301d3c4b6aecdbca10ff1eb", @ANYRES32=0x0, @ANYRES16=r0, @ANYRES32, @ANYBLOB="18007070020008000100", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x8050}, 0x0)
close(r1)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0x307001, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
ioctl$KDSKBLED(r2, 0x4b65, 0xa36)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x10040, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000040))
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_inet6_tcp_SIOCATMARK(r4, 0x8905, &(0x7f0000000100))
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e)
ioctl$KDSKBENT(r5, 0x4b47, &(0x7f00000000c0)={0x8, 0x7, 0x101})

15:51:33 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xcf, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xffffffffffffff03}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SIOCPNENABLEPIPE(r0, 0x89ed, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1885.974825][T21879] ubi0: mtd0 is detached
[ 1886.111212][T21896] ubi0: attaching mtd0
[ 1886.122954][T21896] ubi0: scanning is finished
[ 1886.203136][T21896] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1886.216310][T21896] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1886.228464][T21896] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1886.249014][T21896] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1886.266994][T21896] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1886.277315][T21896] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1886.293625][T21896] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1886.326660][T21896] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1886.359478][T21901] ubi0: background thread "ubi_bgt0d" started, PID 21901
[ 1886.366802][T21899] ubi: mtd0 is already attached to ubi0
[ 1886.375990][T21903] ubi0: detaching mtd0
[ 1886.397455][T21903] ubi0: mtd0 is detached
[ 1886.423900][T21904] ubi0: attaching mtd0
[ 1886.428840][T21904] ubi0: scanning is finished
[ 1886.508401][T21904] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1886.519236][T21904] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1886.535740][T21904] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1886.546497][T21904] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1886.565687][T21904] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1886.578398][T21904] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1886.598614][T21904] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1886.616863][T21904] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1886.628274][T21913] ubi0: background thread "ubi_bgt0d" started, PID 21913
[ 1886.648540][T21899] ubi0: detaching mtd0
[ 1886.662954][T21899] ubi0: mtd0 is detached
15:51:34 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xcf, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xffffffffffffff03}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SIOCPNENABLEPIPE(r0, 0x89ed, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:34 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0xa020, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)="41b8a41333e9936806803241260aefcabc78457bd1f9dddbc441320734148dd0214c7a784b250c2881cd7583bf48b0f8708e", 0x32}, {&(0x7f0000000180)="2303829e72e14085b900ab25538ba3b297f65abf06405d634c46e2da8a66333268f16fab6afe6e55c66d3f2410395568c3e52f1395a4ee800f06792ae40faad4997776dfa371a5e1c1febad37f8aab9d00e9fbe505edbf3173ac36c655e1e054b6860434a49b720f0d677887532b45bf7cd41d0ffe96c686aced1d02366d2542ce4ac4e141d12debe6a92ce0e9e7b914c93a549372fa", 0x96}, {&(0x7f0000000240)="fe65b195ebdebb36baa65081b8915f7fe52849aa079c6bd8ea40a035f88d50db72afd6877e8db5ef7615492fe8f74133568ad51186367aa78b859d9f9bb70c0a64a931177b9819c0674c3ad7565692393074b6d6a02b35ab1c87608e1a797af2317ae06618a6d521b0ef3a98697c9376c27c3c9f8165593b7a7bab6f8e1249220faa46c901a1a4391b310683a26fc56d81cd700121e5a1f2ad16292c199eda5fee32635eee499081aaa1491ec2ee239cdc360932f24f8786ee0239e6d0fcb9635e76203ec33c9b71553cc4078eab73292751c9b2b8c6cf7a369364bb393f00b8c0bf9940fd658ce201eb4a0a037521be0c90048758ab86fab32c2209af", 0xfd}], 0x3, &(0x7f0000000400)=[@op={0x18}], 0x18, 0x40804}, 0x8080091)

15:51:34 executing program 2:
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000000c0)={<r5=>0x0, @empty, @dev}, &(0x7f0000000100)=0xc)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r7, &(0x7f00000002c0)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r8, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r8, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
r9 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r9, 0x40046f41, 0x76006e)
getsockopt$inet6_mreq(r9, 0x29, 0x1b, &(0x7f0000000140)={@initdev, <r10=>0x0}, &(0x7f0000000180)=0x14)
sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, r0, 0x0, 0x70bd2b, 0x25dfdbfd, {}, [@NL80211_ATTR_MAC={0xa, 0x6, @remote}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r5}, @NL80211_ATTR_MAC={0xa, 0x6, @dev={[], 0x1d}}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x1f40000, 0xffffffffffffffff}}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r10}]}, 0x50}, 0x1, 0x0, 0x0, 0x6008051}, 0x821)
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

15:51:34 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000040)=@get={0x1, &(0x7f0000000180)=""/222, 0x7fff})
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:34 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
close(r1)
getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000140), &(0x7f00000001c0)=0x14)
r2 = syz_open_dev$vcsu(&(0x7f0000000040)='/dev/vcsu#\x00', 0x2, 0x200002)
ioctl$sock_qrtr_TIOCOUTQ(r2, 0x5411, &(0x7f00000000c0))

15:51:34 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000980)={{{@in=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000a80)=0xe8)
sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x84, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x20004040}, 0x810)

[ 1887.467539][T21930] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1887.626746][T21950] ubi0: attaching mtd0
15:51:35 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4})
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f00000018c0)={0x4})
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x24044881}, 0x8000)
close(r1)

[ 1887.677816][T21950] ubi0: scanning is finished
[ 1887.697830][T21944] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:51:35 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000e64e00450000da00"/38], 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x7)

15:51:35 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0xa020, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
sendmsg$alg(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)="41b8a41333e9936806803241260aefcabc78457bd1f9dddbc441320734148dd0214c7a784b250c2881cd7583bf48b0f8708e", 0x32}, {&(0x7f0000000180)="2303829e72e14085b900ab25538ba3b297f65abf06405d634c46e2da8a66333268f16fab6afe6e55c66d3f2410395568c3e52f1395a4ee800f06792ae40faad4997776dfa371a5e1c1febad37f8aab9d00e9fbe505edbf3173ac36c655e1e054b6860434a49b720f0d677887532b45bf7cd41d0ffe96c686aced1d02366d2542ce4ac4e141d12debe6a92ce0e9e7b914c93a549372fa", 0x96}, {&(0x7f0000000240)="fe65b195ebdebb36baa65081b8915f7fe52849aa079c6bd8ea40a035f88d50db72afd6877e8db5ef7615492fe8f74133568ad51186367aa78b859d9f9bb70c0a64a931177b9819c0674c3ad7565692393074b6d6a02b35ab1c87608e1a797af2317ae06618a6d521b0ef3a98697c9376c27c3c9f8165593b7a7bab6f8e1249220faa46c901a1a4391b310683a26fc56d81cd700121e5a1f2ad16292c199eda5fee32635eee499081aaa1491ec2ee239cdc360932f24f8786ee0239e6d0fcb9635e76203ec33c9b71553cc4078eab73292751c9b2b8c6cf7a369364bb393f00b8c0bf9940fd658ce201eb4a0a037521be0c90048758ab86fab32c2209af", 0xfd}], 0x3, &(0x7f0000000400)=[@op={0x18}], 0x18, 0x40804}, 0x8080091)

[ 1887.861666][T21950] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1887.876236][T21950] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1887.900108][T21950] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
15:51:35 executing program 5:
r0 = fcntl$getown(0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x1400b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/nvme-fabrics\x00', 0x400, 0x0)
r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/rfkill\x00', 0x20841, 0x0)
fcntl$dupfd(r1, 0x0, r3)
getsockopt$bt_sco_SCO_OPTIONS(r2, 0x11, 0x1, &(0x7f0000000200)=""/224, &(0x7f0000000300)=0xe0)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000040))
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
modify_ldt$write(0x1, &(0x7f0000000180)={0x5, 0x20000800, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1, 0x1}, 0x10)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
write$P9_RXATTRCREATE(0xffffffffffffffff, &(0x7f0000000400)={0x7, 0x21, 0x1}, 0x7)

[ 1887.966730][T21950] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1888.010618][T21950] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1888.040549][T21950] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1888.068234][T21950] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1888.148468][T21950] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
15:51:35 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="4000000010003b087aec0005fd695e418c6beed418f984e92677d166e667e95c964cc538af759cc8eae934c0434c0c8725c9a4b986f40fb710473e06680ec7012bba3293553660c0db6d0fe0899f70720c50c258a9fc02e53f95041000a86e28a1c43cc308aa794cb4114275626d6db3fc8a70fbac8200b2aeec6688f520e74fda854598fb410092fa9c62a208e060a95b7310885c2f5b38f0c5b77528eb2d4e91bb09a76d9924b6aa846f74006760724f04ecb0c6ca09ea4eb6382253c9a3eb8c628217a23aa2cfbd5cb77eda39d0a0618a7274d5312e1029bc2834a2fb630d239d36cec8c0b74e9a781bd3f97ac37fdf11ad7bc86c2da7080dfa2b9ff45925ef982a7ebc11d0ea2c10399b096b7c2053e9eb9201da9c725900a0212c614c6bee106b40fdaaa2a4e2a5918b5d0968721bd6ae5a53a4cb24a6e2fddece4d5d313e4d1ff083399dc028a47639a316cc9fc2448d3827ae8fe83999d319dfda568aa9bd12f4605775f4ff5f16eda6c69f6b24ad6bffa5ccb49446832e033e4c359a82b943e7fc11f0eb4fed68c40f45dcf752c8b4b0d9fd5a3cbe38b38100000b165f81972c955d950d84e47c329d165c880fc4ca70757a787c48bca21544a3a2975d76db3d2698a576519b06056c823ab1943b40864b52850571a7c5f7430b85ee5a6194c83355ecfb2fc9b71aca34fe1275ff03a31ca516f872f155ec042cc8695734f6fad1eaca4fd5c30cf669b8d8a2e523ecd46d81a0ffa9a18d0cd12ccbb90cf0e1b5ce9022d8e12eb7a0c2174b75bbea2b7ff0cc3d58e5421a4381fb0c72898d5912a80587a9bf88271046b6cd31bc04ee359b78c0d48a21916e77e0b96e9a14c8ac3ce58134219fa638b4c6550782b9c4f42af3372fd64cfa746766c65098130b85759aadd8f5ba94fcbe7acf43206d1ccb51fd0dd24ff9542b3db5176353a96821084406b492b5e469e023b1b6ee46fc9ac2a4f6967c60d82125e65a126211270433ad33d75832085c50fdce038856412e545afa8903bb69ab20fda6d5221e9766538214e3ded14f7441c4ec53f66a8c13992a74566661db258a56e405a6b7e0cc3c13c711c36c01e352f49f1d7f588a4332b56ee38df1e84be093bc0575d69690adf774e6cb9d5dbed31e1c3bff63e706ecea67f123c64f06db769f9555ea1f57747672c227881cf6e5686bfbcb72ed178e91d9472b6a7b8fb1c04b3afcdf85477e7e9154ca7e032a219079c927078a4c010645df2ef51461ac32ad008024ef83850be66f242f881631585c0950e2f6a7289669f69fb9fad74441c92dc918a3cc8129bf42e3952424590ab25784614db5bf3cf3cf1f53f81dcf40b84ec95fbb10a9c98f234e9838ca00"/985, @ANYRES32=r2, @ANYRESHEX=r1, @ANYRESHEX, @ANYRESOCT, @ANYRES32], 0x40}, 0x1, 0x0, 0x0, 0x840}, 0x0)
close(r1)
syz_open_dev$hiddev(&(0x7f00000000c0)='/dev/usb/hiddev#\x00', 0x4c2, 0x26a02)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e)
ioctl$DRM_IOCTL_MODE_LIST_LESSEES(0xffffffffffffffff, 0xc01064c7, &(0x7f0000000340)={0xa, 0x0, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0, 0x0, 0x0, 0x0]})
ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000380)={&(0x7f0000000200)=[0x3, 0x8000, 0x35d83d03, 0x7fff, 0x4, 0xb40, 0x3f, 0x100], 0x8, 0x80800, r4, r1})
r5 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xa00541, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, 0x0, 0x40008011)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xed, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x103, 0x729}, 0x0, 0x0, 0x7f00000, 0x0, 0x2, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/nvram\x00', 0x0, 0x0)
ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f0000000080)=0x101030)
r6 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r6, 0x40186f40, 0x76006e)
openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nvme-fabrics\x00', 0x404042, 0x0)
ioctl$LOOP_GET_STATUS(0xffffffffffffffff, 0x4c03, &(0x7f00000003c0))

[ 1888.226301][T21962] ubi0: background thread "ubi_bgt0d" started, PID 21962
[ 1888.238746][T21981] ubi0: detaching mtd0
15:51:35 executing program 2:
syz_emit_ethernet(0x14e, &(0x7f00000002c0)={@local, @link_local, @void, {@ipv4={0x800, @igmp={{0x2a, 0x4, 0x2, 0x2, 0x140, 0x64, 0x0, 0x9, 0x2, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@cipso={0x86, 0x6, 0x2}, @timestamp_addr={0x44, 0x1c, 0x10, 0x1, 0xa, [{@rand_addr=0x64010102, 0x2}, {@multicast2, 0x5}, {@private=0xa010101, 0x5}]}, @rr={0x7, 0x1b, 0x4a, [@dev={0xac, 0x14, 0x14, 0xf}, @dev={0xac, 0x14, 0x14, 0x3d}, @loopback, @broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @cipso={0x86, 0x37, 0x3, [{0x6, 0x8, "d92689177e01"}, {0x5, 0x3, '+'}, {0x5, 0xd, "e0a32b5b12245cfec56835"}, {0x2, 0x7, "6daeb5588f"}, {0x5, 0x12, "8550d16bd2a4d130944a9cc393d6f907"}]}, @lsrr={0x83, 0xf, 0xf3, [@broadcast, @private=0xa010100, @local]}, @generic={0x44, 0x11, "98b6d9374e454bf90795e789d6ceca"}]}}, {0x17, 0x6, 0x0, @dev={0xac, 0x14, 0x14, 0xf}, "24e0d9eb8abcfbfb079a36e3e2b9b0c52829109349d58c4695606a362716a534381997bfe69751b6094898dd2f7bcaf4bd18ec5b8367369824feb758cd07740be2b6552d4720b9e57c9422d0ede86148ecfb282b926201fb1ffd344929d77d3a7c1d1d2ea4144960020852f292e3502647990e411c0eee45f06e704ade9debb4c6a407486096dc4004f82c7498b4ef14"}}}}}, 0x0)

[ 1888.344583][T21993] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1888.362502][T21981] ubi0: mtd0 is detached
[ 1888.458275][T22001] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1889.179687][T22010] ubi0: attaching mtd0
[ 1889.184650][T22010] ubi0: scanning is finished
[ 1889.801029][T22010] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1889.808861][T22010] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1889.824438][T22010] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1889.848236][T22010] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1889.859195][T22010] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1889.871731][T22010] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1889.879987][T22010] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1889.897464][T22010] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1889.921710][T22025] ubi0: background thread "ubi_bgt0d" started, PID 22025
[ 1889.929006][T22017] ubi0: detaching mtd0
[ 1889.958538][T22017] ubi0: mtd0 is detached
[ 1889.963750][T22021] ubi0: attaching mtd0
[ 1889.973164][T22021] ubi0: scanning is finished
[ 1890.072239][T22021] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:51:37 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xcf, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xffffffffffffff03}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SIOCPNENABLEPIPE(r0, 0x89ed, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:37 executing program 3:
perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0800000000000000c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd07913753038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7009a78d75103000000c91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa5c32f12b9226ede1883a93a1cd00b5af91251bb6518516fe34426d03702ea998badf60f3cf6131405dceba98e6c66afb64d76e8fe56298612c540ca5facba4b5a17f1d217c35b284da238a77b56a24df3a847b35b1dcb6e11ddedbf0680f1a3ee2fb793778bd9909af94393acd"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:37 executing program 0:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
ioctl$HIDIOCGRAWPHYS(r0, 0x80404805, &(0x7f0000000240))
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:37 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000940)={0x18, r3, 0x7, 0x0, 0x0, {0xb}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}}, 0x0)
sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x820000}, 0xc, &(0x7f0000000300)={&(0x7f0000001580)={0x12b0, r3, 0x800, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x108, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3cc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xac}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xad}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x10b8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x433}, @TIPC_NLA_NODE_ID={0x1004, 0x3, "4f4cbbe5ac7ca71c8a682137f4185a6f407c67520c0bf899b6ca2ca845329e569bedfac57bf562bdbd30ef1852bed575ca5458f4178b7139726b58572d33f7ab09df5329f8f6d1a9146533a9a98e16cc0e7ebcda50c41f3be35b9cd5333f901ed13da59fb9b6ff8cc778e358ba1f6211eefde597a67b0e202b211956fdf653757d4f7d60570034be0f24cf88e708566b67c2298d7dcb0aec48334a50b082ff72513e6e289d8bf1f2dc005c6c208fc022e9471284b50b1e3041e04a4113126c5523f77152d6dc7147c8cd12ae71ef243f9131b15e60db7897ecae8644eb2dfb8e874ea06b1511e44f6d84065a07cb4d2c17ee17664301d06fbcacb9c33fb2082c541c19851a34638b8b92e6ab728039ac515c4553196e37b5f3370eba68fcca439d63507613af24b3ba4921361c6cf2c0e5479888676682a20c5bad95b357c3608666c4435fe23ce27b460d90b9b5bbc3b854bd7d388836b243745e440ee7973d02823fa139d35464522070c205970f3499c0746c40018433a41edb309dc3632baf86ea0b6af4eef59644d11ee9a9e06af70b9fdd6c3c28fced57fbbe22478d6a9f16abc7742b321fff78b7d6896141ab92965e288fba0e2e3981bd8963de8e191d57ff41bf0352627226ad3a5e24d6999b3ed3669697bfdf298ae72bfa7fa9f2961fac1e7cd34b71c2331a98d63c780f5b89a733124b9ee89d087168e99da43008cc2a0ff6f2c81958f4682e9d3df4f5e12a177fabd2ca968fe8440087747777c527e4333d205be41b5727f1271e5ec9ad2c8738eb1e734ae83f24845bf06323eaa2a818257fb13d07ad50fa71cace5f468baae63d8b32a4f91137d14a015b0b10733969fae0a4c11b64ac525d6956d8ba69d54bad326c0a2f7fc8b6f5a4eeaa229385ef62a2be416494372def72392e80077b0297db2d6161ee9bfe51e154e9494b3498d33ee53d612101a44d39149be85cf0fc8c9467157a9b4eeb161a7f13e8373517de8e47d6a61cd978a8c5ef7c1703efa6bccd237d848c7dab30b19a53e8189f2b67cb55cf03f912ce3350eb11b4c0ad29e987bf93a40d83ca1bd6afc94ec9b145bf033d7be8fa7591f7a9c08e771a51df1b15220af9a3367b41099318ec527dee5b1d199263a197b5efabb409a97786440eb5b84893a19c121e22ace5184d989d49d06ee0ceef992b50a91c7b120108ec19f5ef6de9c0718fad7af7237c5f11c41ba116bd37e0bcaa5283adac6856c753d7329598f8291f154e27adf43b0be0e8fbd1e6275451b6e522e865d3f1ba1ced56e545cb9d1129eb85b2d3bf94444adbe4d4bea9a76e7e55b40da50d3e06c96d200af128b2bf66108ce477161e27fd2ad0e0f8b936eb5d5483254e19d45da4761863c2ecf5824d773c0cf19e02020f599aabc3b9c155aa6654101b915f88f60c6790c74327ffb73516c0bb8b27608722541ba7be0c5ce40d2b5d81425facf141ffcd3177fda683d86f85c3dee6775b10e36d789531a7dd94a017a22e57bfb914851bfc421d4acc9135999e4a28559503175a267b7bad3a734f9732076fc081aae9e8b80be8405783c9f4da24483c10ffdee20f486251ef0ecda16fd84d93debd96e537a6a67be0431ecafb72d34c8904733217b1f01f1a4634adf15a20c344cc076e1cce6778d512d6860b4f769ad2416d08224c79ed0c9bb65412194b3f2b88661678b8bade40c8560f18b5817870c34dc5cb0c8d5f12c379e2bc327ff373ab5c3ceb2739ffa153f872cf70ac5a4c0719d7a426802daf3de9753a71a67e04a635c80c24a85d54fb48a9fa65dc9320c94a4cce286428a3046e2a5ca4e7175c14b6bb3121595a47fa27ab706a7995c4d0d047a3d893d71f2c9e5f02dbe1d51e18dd06eafc21ae520d463a6b8b46f7ea21dfdbea003b301900e121aa520bd67e7e8ad7edcb88ff77554aff6081d1200540ad2764a1065dd14f2d8983523f991c2b1501ec09eb98cd311860b95c2bca8139dab0789a483d31cfefd3d3a4ea5a9198ba2b7baa528c323969e09309a8b8618e9c764eeabd00a426bcf2011e507f86ec375d750b0dea7db915ad778e785c0446297dd3b0987788924b03bc810b48cb47f6e35dc435ac7461eb26d6f83d60dc6e7c42643f78f0e5c43b5e46c12bc947a3ec5ea34238a91835f0bc35cfb6f159e87af371b49226b20809edb6396ca50141d33c7580e8ca382fe9e5407acce4412df5af75670cb7aeca2076c444c71e0bdd339233995be04e5b388ffe05ddf02fb9c3a0c0ac52cb15a71e61ccca143d0351b1a61e11fff3652fc09dacd2b392f8d39a3296f9286c0da3b2cb41c02ec361050edf9e6148893641d5f06769c99ba9ff988d961eb0c82c6e48bb8e101be5de0755d7f395e515ce67698e1efcf97f5da8f2e1a6f7588c0082d09ce802ca29624a765582372a14846d1a96174a5b617e64ce47a5d85dfdf94b5b8585c42257199b2c6023792b78baa75c477690ce954d3f7a0d944de450f3a80edc80f7bc822ce4dd9811cbb84e02bb4a47aebc5bfe0ab5ab0faa1c304444cf8902d6800ee179bffef3ab2c92d2ef081822a337b1dc694f079f4803dffa8eb112a617c06e3f8f9e6ae0d6af67ae0aa73defe6719e142524b5d8b9b3c60b1d37d07301a483e1976481cfc46809a6c75d5018c7a85e35064e9e7fcf833aa3f8d4591d4193e910a7af8fcb53f0546f67354e2336bb56f293314cb2b8313867b6d4a0d7cb493fe8b387068389b8cc03d573a8b346d5070606bee23fd72fc5fe15b08814e029d278fee780e0ad2ff7cfe24a82311db922cf6a1071dbf68895fc63b1f79ee857e3778c9366bb5090702b2e11ab15e1b18fa491f44ba4fb6cb75d48aa7b30eb60ea5f2e086bf5b8e7da17895d89a2e629af1e10c95a2b83cecc5c74bfae4c65ff3be1ea4212211bb807adfe5a7c00914fdc1228a23cd2a344a31b653b0cd4a3ae807d245f3264637eb0545c79d8e99e55204bae0ce1ce204f9f4c72460583b1123ae6b81183581af15cdf400ef40542b795dcc91257f383578ebcafd04b0751334e5f76da8a1400b84e72d2e1ba99970d782b3d9c5e043260a7033a87ab1367fed961cfc7c37f4b131287c2ef649fdca83a6ea17627c62fdc83e1abf3d5757d5a120b57b8650051d6222b2ed64d34e693bccb4c981916dad59c04739416c3f14c7d84d579f00f3c3f12cb3e39a25f07b2f28d772521fcd901589d9976cc3926fd966eabe6cb3e3ae18185c4b238992ce5e0470820e912ec1074da995af971a4b0521169871edc63aee350ca8f55c696c060ba46b989b7f978b501f85ae002c5b4a6f6ad5403604ccfbd5ec3c28282647144cebc9e6dc7b248cea3fd6b5659e05bd74d2f8ba5f29ad89ea208bd8db33f0c10459c64202e754a36a1aeca10cb8550990f9bc7050320162a7ec5c7f2ee3e030fb8ae7d7ad317dfb3dc24e587d259064d08caa77d35b4990eb2aa777792840613fe8685a07c32121e30bf936265435f8ad2d22246ec2e39824a3ffb0c9c1ddc90185af63735838b791a0087f38fc8d0a4637adb636d062f450339c2b74c7f473e11b5212ba84175a6c89fdf106ea8479aa5147da8abb4a6052e10422a130f2e049c2d8d26a26e00df97364cc619c3ff5edf2f88019741e4e056241c8b172bc780bd22da621464f8ab4602c12d3e1d7a38ed4eac74da486aa3e413a46fc2b3555837ebf8f9fecc032c05093ef26de24ed172d6279425af8c5f5801860d3c828f79e81689b729c066351361b60af2b37beefb88ae853ce67df835fb2bcba21a6263c2b1d899a948c4328fb9d19b959dbf803317e1e2dd51c7340f56fccf26287a51fc15ab759e8453e681f9b0fa28a4bfedcc1009ddbb6e8ff15f3eb398a51dd93c53e42a16c944bdf5321b8b025dcf6c3b06f3e50a37edd2fe4cfcba218b9d41fbe100d8e096cdae32808be5d51f4b58a90ed879a177bc54fc69b8047eec17e3b53b1c3c44d8873887b021e5b7a86e21395c54928e7779902b0e6d8381acad7fcaaa77489fdb6cdde854eb3ae07c63a84c553612ea9f5376c3e980a52035f01007b0136fa84edca0073d5bdfde95bf49c4031db63733df4e89f1b842d81e53c395d992c03a81362466f9b2fbf8b2ecd5a1e36f35661ad7a3b7ffa2b77da1b3133534b412667fb49c7ef18fdc2d9156c0591017b539e6780522f6513b53ff07e18d3dd285a99426206b317aac56b082ffc88088bb9e107723f5ee3f86643a35b505893031385306a4319f294f7f1ef6b7e8d81be92e37e06e3cbaf90d794160df24ea846db82117a0ae2232848c7b91ea4ac6887d0e9430dc61ddf802775a265f57309378f6d489da84bbfc1b69c24ca1b5885e622973110a83c7ab2e82d484fe3a94528cc71203f3ab2b9561134a7c51e34486dbb6a50ab2e02216a3875fc4a2b9017662bb2c14fa3f63c89013c97d8bb51c2ebc1a5df4e1ce187f85f3edc4c4e6f1914459a533bfe5bf3d7e5b9b1db1a2c46194577b65177b8a153d13237a6c92c3bdd24aca1282eabac0d0f59a1bec0083e029ecaee958809196ff9ee1e6aef7440910b406e9a50b2c3443a8364dd853646567ab592085786cb887e8d83ffce8df0a3fe45f77ac3657a5497917b524b08d37b56d1ed1fed92dcaf4f1998059799ab0b59276fb13fef58b95a31600e1123ccc674b09e84bb0041f01aab4f5e3e75f72fe1c92e8165e5a8df22b1c1a132b683a713365637b3ac36f94c0879b88f499b3752c6d31073c9e52ae8b5141c0052d795cc4b5e4013fa8e6b6ecb08c7832e31d677284543d326b07ebc3d3b86eb1927b17da77801163f767477d2aad32c6d1597294a1967c91f0fd362e610efd203b8420bbd3365fcd5343bf2b091be85b1a0d016fc4584e6b67c5f6ba77ccc6c2c8d6a8719e41d66c6a5fe106e6ab239c13f38977c94ef095db7174955d2babb215fb414394547296c36e0d62fbf9e3b2e6249fe8e17d877f2a67b03ad5ade1df5714715abc032fabd80e22eb2c2beb5865a09e3422bb4ff06909f8854859da69904fea9b0b7b1d095030df94aaf78e1ee5c176fc7129537d2ab175b12db4bd646f1b100e93b6de059de1f22d61d11f9c5b9972c53a09951a6312eeb2b63f84610f83e1ac0ddc6dc236abccf0ec3165ab8a9b317edc559324722c72317e9bd63fbb612bfca360b51a2a6e7f46e932109e440b72eb645105cd5f13d109cacc63bb253482e5a6ac19433d1e7f0bb360489172c84b33bfc6e28a63b4560aa85bfe2ce2f6c3a67a763971810a4d557f1986c8382b91d58698803935fb73ab83716040cacf0de76caa1d08156165615921129d445954e777533a31d442caa880ad9ca7147a7c1a4ef9f81295687ad4b4423fa59d295e3b6d3fede96ca903bd07192c6f398e8d4c1e7b3be18668a7da6cf7511e72a103f084b1864a3e94d915e2834bf2834c6dcf1cf7a2c035b29a4ef1299d9d6eafff6f853fec35aae75a0ae38582add41107919638e3c2e5580487330fb91e12c41658a720da624ecb4ee2f0cd43a277f1e73b672805984374d72727618236b1b97dbee4babf10a81d999b60fd5d78d8b63fd74fdf8cc83df4d358a553c1fc6e9a60f016ade8b896ecaad14c7366760acf8c0018c0068a701aa10796218de24a496948fbb7a8a5786dce200eedca18445005085597fc78a17c789d58b63732993c64af7de83c0e064b90c77056424d216515271dd6218d74946dd3c36808b6b415ea41739d645fd78b23f1a07a04087b469bfc7d44ac58494eafe9682bb5"}, @TIPC_NLA_NODE_ID={0x9f, 0x3, "0f111753fbfd050518a96719b4e49845f6484ab84bf6d50fc535311722354f4da477cd28e5ec70fcd308f4b1e00abc72b5ebc543ccd28735cedee74d7246294ce5294ccbdede4ce10d794a6efc6021d4c5292a922d5ff9da7feb2964eded5865bba53049b92504dce5c6f251c1c81074c2bf5cf19a4afb6c7f99b8124b7b79e1e4faefda2ba78a9729b4d18050466ecc83701f6362dc9702b21ef0"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fffffff}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb6fc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10000}]}, @TIPC_NLA_BEARER={0x90, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'syzkaller1\x00'}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5a0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}]}]}]}, 0x12b0}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mknod$loop(&(0x7f0000000100)='./file0\x00', 0x40, 0x1)
getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000001500), &(0x7f0000001540)=0x4)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="000000000000000028001200090001007468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r6, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000000c0)={r6, 0x1, 0x6, @broadcast}, 0xffffffffffffffe7)

15:51:37 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003b0e7a00"/20, @ANYRES32=0x0, @ANYBLOB="deffffff1f00000008000a00", @ANYRES32, @ANYBLOB="1800120008000100707070000c00020008000100", @ANYRES32=r1], 0x40}}, 0x0)
r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0xc0000, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r5, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
sendmsg$DCCPDIAG_GETSOCK(r2, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)={0x20c, 0x13, 0x400, 0x70bd26, 0x25dfdbfe, {0x1e, 0x0, 0xb, 0xf9, {0x4e20, 0x4e24, [0x2, 0x3, 0x8001, 0x33268200], [0x1, 0x40, 0x5, 0x8], r5, [0x8001, 0x40]}, 0x1, 0x1f}, [@INET_DIAG_REQ_BYTECODE={0x96, 0x1, "1cb5d374a2b79a00847817bf1fbe1e888b779fd544ce1a23b124f785d337032dc70299bb85ba55bf5225db97be659702cb9ea7c3863c0cef4aeb27d311f086167822dd556d06d191030ed457a4a5a1b719065c817542afb232d7af7efa3447a26e3dc30205cdca23bcec8b374c11f0645fbdd6d73761653303728e05d1a307ec531d7292db02944362807fe3d433767c6d5b"}, @INET_DIAG_REQ_BYTECODE={0xffffffffffffff54, 0x1, "8d2bd9cc0a4b6490954576b8fe6cb94c74c0bf3338f0dcffffb8d81380373bdf110000000000000002cd4241f5c867451aa8809c6886096652f76f2f9305222a970bd432ed087762b2b905bff987283e6b868efd8e945bbccc6459742b39d60ba9bac49677f16b2384fac058f14f7b6e67d54c9b6be054a4e8994a4efdcad61f8d867e22eb2449dd65dbbd51987ca9938c00dc7a45dbdc0b5d382ced4c71edda4e69129ce9d032b78882f77145138a42124b14686986c0bd8e5ac73baaa33b477590a1b791dc33f68e6aa1387ee07fedb7223eaeccde92f3f79196ae2910a243c375284a4b075dd6f5d7fe0000000000000000000087"}, @INET_DIAG_REQ_BYTECODE={0x35, 0x1, "6ab426a7859074914deece46a366fc9cb84e7635deebc1972221a1b48db819307d314a25fdb4df15897f6b3d55a390dd98"}, @INET_DIAG_REQ_BYTECODE={0x5c, 0x1, "9b8732e5cc952448aab36ee05d2d0bafe46eac5afcd228553806dac65b02e84bba9fc9621e961426197e1fcc01104f52d27a8eb60a0f1d4c65d0ca3a03389a7416ce0b7de1de8ed518e919acb9817b574d560d6dfc310bc5"}, @INET_DIAG_REQ_BYTECODE={0x2a, 0x1, "00929f54b9fe9e22be0e44ef85e7944624cc09773874e0fcfa800d851c830499eaaef4c86c9c"}]}, 0x20c}, 0x1, 0x0, 0x0, 0x20009870}, 0x24044881)
close(r1)

15:51:37 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001140)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3019c13bd2321afb56fa54f26fb0b71d0e6adfefcf1d8f7faf75e0f226bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ceb9fbfbf9b0a4def23d410f6296b32a83438810720a159cda9036b4e369a9e152ddcc7b1b85f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa00000058138d3d0000000000000000000000000000000000020000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f7da31cf41aabbdd343fbfff4583d06c91fd6b11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec309baed0495f06d058a73650d6fe048ba6866adebab53168770a71ad901ace383e41d277b10392a912ffaf6f658f3f9cd16286744f83a83f128f8f92ef992239eafce5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cefd4a2b94c07bd5d4aa10aed8477dfa8ceefb467f05c6977c78cdbf37704ec73755539280b064bda144910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06dddeb61799257ab55ff413c86ba9af34c270246c878d01160e6c07bf6cf8809c3a0d462357b22515567230ad1e1f4933545fe2c741374211663f6b63b1dd044dd0a2768e825972ea3b77641467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cc1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc20f49e298727340e87cdefb40e56e9cfad973347d0de7ba4754ff231a1b933d8f931ba3552b2c7c503f3d0e7ab0e958ad0700822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2af79b8d4c2bf0f7a2cb032dad13007b82e6044f643fc8cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942e367f603e3856a346cf7f9fe0bc9f2a1a7506d35e5eb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814458a8125df532d87cb04c0174326d2c0002dc79bb7a51ccb589d075d2e5028fffddb88967c2eb6daf68537d7593372a3418e1edc418f22d1c66023f1d937d41553e1501cd55b91dc02097f3c94de004a3d49d7bdfdf3ec2a0b698a360832907a6ff63efde66226aef551262e1ff2be49db88f4d2718cef246eef210db85bcc1e1d6ecc1c51b538d352e6c1d55a0266ad1d0d561d837d000000000000"], &(0x7f0000000140)='GPL\x00'}, 0x48)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r1, 0xc0, &(0x7f0000000b00)={0x0, <r2=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={r2}, 0xc)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={r2}, 0xc)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1890.275962][T22040] ubi0: attaching mtd0
[ 1890.291839][T22039] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1890.299671][T22040] ubi0: scanning is finished
[ 1890.323430][T22047] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1890.441900][T22040] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1890.459035][T22040] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1890.470503][T22062] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1890.498786][T22040] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1890.518928][T22070] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1890.576767][T22040] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1890.610552][T22040] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1890.617370][T22040] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
15:51:38 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0x6a3, 0xccd, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x7f, 0x60, 0x5, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x3, 0x1, 0x1, 0xbf, {0x9, 0x21, 0x7e, 0x9, 0x1, {0x22, 0xd80}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x8, 0x3, 0x81}}, [{{0x9, 0x5, 0x2, 0x3, 0x3df, 0x7f, 0x9, 0x4}}]}}}]}}]}}, &(0x7f0000000180)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x80, 0x3, 0x6, 0x20, 0xff}, 0x5, &(0x7f00000000c0)={0x5, 0xf, 0x5}, 0x2, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x42d}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x408}}]})
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000000300)={&(0x7f0000000240), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, 0x1, 0x2, 0x401, 0x0, 0x0, {0x7, 0x0, 0xa}, [@CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x1}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x4}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x3ff}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8400}, 0x20)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r0, r4)
getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f00000001c0), &(0x7f0000000200)=0xc)

15:51:38 executing program 4 (fault-call:3 fault-nth:0):
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1890.695472][T22040] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1890.740499][T22040] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1890.783294][T22061] ubi0: background thread "ubi_bgt0d" started, PID 22061
[ 1890.791091][T22042] ubi0: detaching mtd0
[ 1890.838645][T22089] FAULT_INJECTION: forcing a failure.
[ 1890.838645][T22089] name failslab, interval 1, probability 0, space 0, times 0
[ 1890.852376][T22042] ubi0: mtd0 is detached
[ 1890.865572][T22050] ubi0: attaching mtd0
[ 1890.882198][T22050] ubi0: scanning is finished
15:51:38 executing program 3:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x3c43, 0xb0004, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000003c0), 0x8}, 0x4220c}, 0x0, 0xffffffffffffffff, r0, 0x3)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fb81b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea704000000bd00009b4f32389c753acb8026fd80aec7d848362f9a78d7516f8f25bfcd1c15d7dc2adcdefba0868942577d8953191eeb793798295d2b10737d4e25a22695df1c990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa000000000000"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
sync()
creat(&(0x7f0000000000)='./file0\x00', 0x0)
lsetxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file1\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file0\x00', 0x8, 0x1)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:38 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000040)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1891.024049][T22089] CPU: 0 PID: 22089 Comm: syz-executor.4 Not tainted 5.8.0-rc4-syzkaller #0
[ 1891.032774][T22089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1891.042883][T22089] Call Trace:
[ 1891.046201][T22089]  dump_stack+0x18f/0x20d
[ 1891.050560][T22089]  should_fail.cold+0x5/0x14
[ 1891.053367][T22050] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1891.055189][T22089]  ? tomoyo_realpath_from_path+0xc3/0x620
[ 1891.055206][T22089]  should_failslab+0x5/0xf
[ 1891.055223][T22089]  __kmalloc+0x27d/0x340
[ 1891.055243][T22089]  ? rcu_read_lock_sched_held+0x3a/0xb0
[ 1891.055268][T22089]  tomoyo_realpath_from_path+0xc3/0x620
[ 1891.088903][T22089]  ? tomoyo_profile+0x42/0x50
[ 1891.093596][T22089]  tomoyo_path_number_perm+0x1cb/0x4d0
[ 1891.099073][T22089]  ? tomoyo_path_number_perm+0x183/0x4d0
[ 1891.104743][T22089]  ? tomoyo_execute_permission+0x470/0x470
[ 1891.110581][T22089]  ? lock_acquire+0x1f1/0xad0
[ 1891.115277][T22089]  ? delayed_put_pid+0x30/0x30
[ 1891.120065][T22089]  ? find_held_lock+0x2d/0x110
[ 1891.124884][T22089]  ? __mutex_unlock_slowpath+0xe2/0x610
[ 1891.130532][T22089]  ? lock_is_held_type+0xb0/0xe0
[ 1891.135499][T22089]  ? __fget_files+0x294/0x400
[ 1891.140196][T22089]  security_file_ioctl+0x50/0xb0
[ 1891.145148][T22089]  ksys_ioctl+0x50/0x180
[ 1891.149409][T22089]  __x64_sys_ioctl+0x6f/0xb0
[ 1891.154023][T22089]  ? lockdep_hardirqs_on+0x6a/0xe0
[ 1891.159146][T22089]  do_syscall_64+0x60/0xe0
[ 1891.163577][T22089]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1891.169496][T22089] RIP: 0033:0x45cba9
[ 1891.173394][T22089] Code: Bad RIP value.
[ 1891.177490][T22089] RSP: 002b:00007f2e0f4d2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1891.186002][T22089] RAX: ffffffffffffffda RBX: 00000000004e5c80 RCX: 000000000045cba9
[ 1891.193983][T22089] RDX: 0000000020000000 RSI: 0000000000004601 RDI: 0000000000000003
[ 1891.201975][T22089] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1891.209966][T22089] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
[ 1891.218045][T22089] R13: 00000000000002fe R14: 00000000004c5931 R15: 00007f2e0f4d36d4
[ 1891.230895][T22073] ubi0: attaching mtd0
15:51:38 executing program 0:
perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0800000000000000c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd07913753038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7009a78d75103000000c91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa5c32f12b9226ede1883a93a1cd00b5af91251bb6518516fe34426d03702ea998badf60f3cf6131405dceba98e6c66afb64d76e8fe56298612c540ca5facba4b5a17f1d217c35b284da238a77b56a24df3a847b35b1dcb6e11ddedbf0680f1a3ee2fb793778bd9909af94393acd"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:38 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
r1 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r1, 0xffffffffffffffff, r0, 0x0)
r2 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
r3 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r3, 0xffffffffffffffff, r2, 0x0)
r4 = request_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)='-&@\'+\x00', r2)
add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, r4)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, 0x0, &(0x7f0000000000)=@secondary='builtin_and_secondary_trusted\x00')

[ 1891.698445][T22073] ubi0: scanning is finished
[ 1891.749579][T22089] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 1892.035863][T22073] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1892.045565][T22073] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1892.069595][T22073] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1892.146973][T22073] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1892.171352][T22073] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1892.267398][T22073] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1892.279302][T22073] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1892.298355][T22073] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1892.321495][T22131] ubi0: background thread "ubi_bgt0d" started, PID 22131
[ 1892.321830][T22078] ubi0: detaching mtd0
[ 1892.345725][T22078] ubi0: mtd0 is detached
[ 1892.357140][T22111] ubi0: attaching mtd0
[ 1892.364108][T22111] ubi0: scanning is finished
[ 1892.461960][T22111] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1892.480460][T22120] ubi0: attaching mtd0
[ 1892.486816][T22120] ubi0: scanning is finished
[ 1892.574858][T22120] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1892.640872][T22079] ubi0: attaching mtd0
[ 1892.645962][T22079] ubi0: scanning is finished
15:51:40 executing program 1:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xcf, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xffffffffffffff03}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$SIOCPNENABLEPIPE(r0, 0x89ed, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:40 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000000)=ANY=[@ANYBLOB="aa07aaaaaaaa0182930ae51308004500001800000000af2009899d5a97992a07d93e225cdbfcc07e17cbb08db186e1b588cc5c32a9e343ea2bd5f636df"], 0x0)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
r1 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000005000/0x3000)=nil)
shmat(r1, &(0x7f0000000000/0x13000)=nil, 0x6000)
shmctl$SHM_INFO(r1, 0xe, &(0x7f0000000040)=""/150)
ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5)

15:51:40 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:40 executing program 0:
perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x40000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0800000000000000c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd07913753038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7009a78d75103000000c91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa5c32f12b9226ede1883a93a1cd00b5af91251bb6518516fe34426d03702ea998badf60f3cf6131405dceba98e6c66afb64d76e8fe56298612c540ca5facba4b5a17f1d217c35b284da238a77b56a24df3a847b35b1dcb6e11ddedbf0680f1a3ee2fb793778bd9909af94393acd"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1892.722642][T22079] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1892.740574][T22133] ubi0: attaching mtd0
[ 1892.745410][T22133] ubi0: scanning is finished
15:51:40 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4})
fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000180)={'L-', 0x8}, 0x16, 0x1)
getegid()

15:51:40 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000180000000000739078ac1e0001ffffe9ff03000000"], 0x0)

15:51:40 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = accept4$tipc(r0, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x80800)
bind$tipc(r1, &(0x7f00000000c0)=@id={0x1e, 0x3, 0x2, {0x4e21, 0x4}}, 0x10)

15:51:40 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000003c0)={'syztnl2\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x2f, 0xfd, 0x9c, 0x7ff, 0x20, @dev={0xfe, 0x80, [], 0x12}, @local, 0x20, 0x1, 0x3ff, 0x8}})

[ 1892.928664][T22133] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
[ 1892.932869][T22156] ubi0: attaching mtd0
15:51:40 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
bind$bt_sco(r1, &(0x7f0000000040)={0x1f, @fixed={[], 0x12}}, 0x8)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1892.933555][T22156] ubi0: scanning is finished
[ 1893.026564][T22156] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
15:51:40 executing program 0 (fault-call:3 fault-nth:0):
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:40 executing program 2:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x101001, 0x0)
ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000080))
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x7, 0x4, 0x3, 0x4, 0x30, 0x65, 0x0, 0x8, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}, @multicast1, {[@ssrr={0x89, 0x7, 0x52, [@multicast1]}]}}, @timestamp_reply={0xe, 0x0, 0x0, 0x2, 0x4, 0x8, 0xe056, 0x777}}}}}, 0x0)
ioctl$SIOCX25SCUDMATCHLEN(r0, 0x89e7, &(0x7f0000000880)={0x6b})
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0, <r2=>0x0}, &(0x7f0000000280)=0x5)
setuid(r2)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40046f41, 0x76006e)
mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000002, 0x4010, r3, 0x0)
syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f0000000100)='./file0\x00', 0x2, 0xa, &(0x7f00000006c0)=[{&(0x7f0000000140)="cc2db9fb391a25180ebd40ee9a16ca66c01b607277e1b852ca0268487b49fee3", 0x20, 0xffff}, {&(0x7f0000000180)="c4e5f9b9efb26d1bbbabfce4ac1cb73cc165334ec4578de159f4df80a9d894b0ef7b5fd9851c2bf128c3bf21116ff6661702b74588c1c72ff73af254579b385beb9ad3c44bc1d072439b41c681256d089af74f364294d427cc498150d38b0780a7600b77ffa4d7696733c1364158e3c45781e7d3a8107b8cbbf3156689f02a4e9bbe6b387d7edefd4ba8c3d9b47454850e6bb309127213293b094811b1462588e1142f7e71df8a3daf560a823e2bccd42e531603a8ebe8484158006b88826e29c9ab2377d5a2a578146eaf79073979e0544dab550fd8b13d975b8922aa2f4101a1092c73f950ad55f50782b939bae6f58617e7fb26ca1695", 0xf8, 0xb0}, {&(0x7f0000000280)="dacc9824379aa5812a8c560c45e4515cd339ae423d63dff2ce5857a540d3a2a3934156d4b1fb4d360c4b292da8d4b057535c45b17c04c2c5c7915a0b", 0x3c, 0xf62a}, {&(0x7f00000002c0)="97eed37528b1b5e17f6f1e28c99badc6917ee39c2586237360f27b74b0f7ce2bea95739c8594b66c690cb8de6ef8e56a2e24408188e39c990e916096960693d395bb3f84e3823f7cfef73ba447835cc78e7a43dd27f4ee84fc25c94a8a3d9c7c5bc7dac55a7a52270d6e37249a06c86048fc03c27c456863d27a5099c4c68e6d254af8b3b2adf1065612dfa17fe9794e315e1c2311c02670ba706556be86c17ab19d28d8513da91580c473001f610c541ea2ec057ec155a529cce4b5ce4ac08ea6d1bd82d08f6eee7ffcb9b3364f3f03a9cdc96f46bbf08b4b1609123198f247a9897487104586f5f8fd9753d0f57d29063246", 0xf3, 0x1000}, {&(0x7f00000003c0)="10183c2022373f73135dc2ccefb7d38f38abad84259324f6fbbea97ac778280edb36b668728e638fb8dcc2e4d893413fcc3ed8271fca161d751945a6e7c9e53efb9aea0e2ded4652f07f49b39cc5d7e9585d358a0e871097201bde2a17d1bb876618f6a062d041c40294fc897b4c5b0cdf5e64", 0x73, 0x2}, {&(0x7f0000000440)="fbfa8719e537c971702f930932441a5f0abfe5b94df8a940534a613bb082a3ddfb8dc4c14a5d205de7c5f6f437d098654534db6e7978c8d1affc84faaed91f77c58a29af42e4e0a99ebbab28242b314b9583f93fcf8da0b79202e6a73c46043fb8", 0x61, 0x100000000}, {&(0x7f00000004c0)="715946d1a8bf9c44d9f66b19ebe2d58aa333ac1fb7514628ff257190a47e4b733089ec7f1f363c3da9d742143e26aeecfa4c6d07a3724ffea7bc4ff7c7d2502eafb1e9313cdf10064d00276b4b3f16a936cae6", 0x53, 0x7}, {&(0x7f0000000540)="ea15f1c78b0f346bf444c64ac99cf9440e97ba005dafd5bf48", 0x19, 0x101}, {&(0x7f0000000580)="b3e050cd79e1fc3849d6fc5d9a35fa852213df881e466c664b25085c7bf7c10c03ad8a4ffe397a9e4107cd640640f75430afdc9e53d38abb28b7f918514650e3ff3c14e906a1c09404e259f984006592e07c24763f39d15fc486ea4259a5b804b5644e0bc45ebf0854729ed3f861d4ddeba809e6b8aeeaa17199af67fe49d994532f25b84ddf5aeff3f6450f497943f478cf29f8b18e7c5891cf2f56b53e", 0x9e, 0x2e848fbb}, {&(0x7f0000000640)="6166c7ec722591f1b0d269151d8f6b4075dc65098e8d115efeb455bdb7ce3d971261cffb606f854706d6f9fb78202fec2c6b5b1c561358033e86bf33ab52f64e568177630f6dba0a6ef192427ad0448a7ddcbae3e8b71faff7207fe6", 0x5c, 0x3}], 0x4, &(0x7f00000007c0)={[{@errors_recover='errors=recover'}, {@case_sensitive_yes='case_sensitive=yes'}], [{@fowner_eq={'fowner', 0x3d, r2}}, {@fsuuid={'fsuuid', 0x3d, {[0x63, 0x34, 0x0, 0x39, 0x60, 0x66, 0x6e], 0x2d, [0x65, 0x61, 0x63, 0x37], 0x2d, [0x32, 0x66, 0x66, 0x66], 0x2d, [0x66, 0x36, 0xb8d56e22daa4d5e0, 0x31], 0x2d, [0x66, 0x5, 0x31, 0x31, 0x33, 0x63, 0x37, 0x39]}}}, {@dont_measure='dont_measure'}, {@pcr={'pcr', 0x3d, 0x2c}}]})

[ 1893.026579][T22156] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1893.026590][T22156] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1893.026602][T22156] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1893.026612][T22156] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1893.026624][T22156] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1893.026646][T22156] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1893.026658][T22156] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1893.027053][T22159] ubi0: detaching mtd0
[ 1893.078930][T22159] ubi0: mtd0 is detached
[ 1893.246392][T22178] ubi0: attaching mtd0
[ 1893.247059][T22178] ubi0: scanning is finished
[ 1893.399122][T22178] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1893.399142][T22178] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1893.399154][T22178] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1893.399165][T22178] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1893.399177][T22178] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1893.399189][T22178] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1893.399203][T22178] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1893.399215][T22178] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1893.404696][T22189] ubi0: background thread "ubi_bgt0d" started, PID 22189
[ 1893.406085][T22183] ubi0: detaching mtd0
[ 1893.422769][T22186] FAULT_INJECTION: forcing a failure.
[ 1893.422769][T22186] name failslab, interval 1, probability 0, space 0, times 0
[ 1893.422892][T22186] CPU: 1 PID: 22186 Comm: syz-executor.0 Not tainted 5.8.0-rc4-syzkaller #0
[ 1893.422902][T22186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1893.422907][T22186] Call Trace:
[ 1893.422930][T22186]  dump_stack+0x18f/0x20d
[ 1893.422951][T22186]  should_fail.cold+0x5/0x14
[ 1893.422971][T22186]  should_failslab+0x5/0xf
[ 1893.422988][T22186]  kmem_cache_alloc_node+0x257/0x3c0
[ 1893.423010][T22186]  __alloc_skb+0x71/0x550
[ 1893.423029][T22186]  alloc_skb_with_frags+0x92/0x570
[ 1893.423047][T22186]  ? aa_label_sk_perm+0xf2/0x560
[ 1893.423080][T22186]  sock_alloc_send_pskb+0x72a/0x880
[ 1893.423113][T22186]  ? sock_wmalloc+0x120/0x120
[ 1893.423130][T22186]  ? mark_held_locks+0x9f/0xe0
[ 1893.423144][T22186]  ? do_raw_spin_lock+0x120/0x2b0
[ 1893.423161][T22186]  ? __local_bh_enable_ip+0x159/0x250
[ 1893.423176][T22186]  ? lockdep_hardirqs_on_prepare+0x3a2/0x590
[ 1893.423294][T22186]  ? j1939_sk_sendmsg+0xe81/0x1370
[ 1893.423319][T22186]  ? trace_hardirqs_on+0x5f/0x220
[ 1893.423340][T22186]  j1939_sk_sendmsg+0x6bb/0x1370
[ 1893.423364][T22186]  ? rw_copy_check_uvector+0x298/0x390
[ 1893.423385][T22186]  ? j1939_sk_release+0x790/0x790
[ 1893.423408][T22186]  ? j1939_sk_release+0x790/0x790
[ 1893.423426][T22186]  sock_sendmsg+0xcf/0x120
[ 1893.423444][T22186]  ____sys_sendmsg+0x6e8/0x810
[ 1893.423464][T22186]  ? kernel_sendmsg+0x50/0x50
[ 1893.423476][T22186]  ? do_recvmmsg+0x6d0/0x6d0
[ 1893.423496][T22186]  ? lockdep_hardirqs_on_prepare+0x590/0x590
[ 1893.423512][T22186]  ? _parse_integer+0x132/0x180
[ 1893.423529][T22186]  ? lockdep_hardirqs_on_prepare+0x590/0x590
[ 1893.423545][T22186]  ___sys_sendmsg+0xf3/0x170
[ 1893.423560][T22186]  ? sendmsg_copy_msghdr+0x160/0x160
[ 1893.423575][T22186]  ? __fget_files+0x272/0x400
[ 1893.423594][T22186]  ? lock_downgrade+0x820/0x820
[ 1893.423611][T22186]  ? find_held_lock+0x2d/0x110
[ 1893.423626][T22186]  ? ksys_write+0x212/0x250
[ 1893.423646][T22186]  ? __fget_files+0x294/0x400
[ 1893.423667][T22186]  ? __fget_light+0xea/0x280
[ 1893.423687][T22186]  __sys_sendmsg+0xe5/0x1b0
[ 1893.423702][T22186]  ? __sys_sendmsg_sock+0xb0/0xb0
[ 1893.423730][T22186]  ? do_syscall_64+0x1c/0xe0
[ 1893.423747][T22186]  ? lockdep_hardirqs_on_prepare+0x3a2/0x590
[ 1893.423765][T22186]  do_syscall_64+0x60/0xe0
[ 1893.423783][T22186]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1893.423795][T22186] RIP: 0033:0x45cba9
[ 1893.423801][T22186] Code: Bad RIP value.
[ 1893.423810][T22186] RSP: 002b:00007f87ac07ec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
15:51:41 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x2, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1893.423831][T22186] RAX: ffffffffffffffda RBX: 00000000005034c0 RCX: 000000000045cba9
[ 1893.423840][T22186] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
[ 1893.423850][T22186] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1893.423858][T22186] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
[ 1893.423868][T22186] R13: 0000000000000a5f R14: 00000000004cd3be R15: 00007f87ac07f6d4
[ 1893.491261][T22183] ubi0: mtd0 is detached
[ 1894.088550][T22200] ubi0: attaching mtd0
[ 1894.096696][T22200] ubi0: scanning is finished
[ 1894.553257][T22200] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1894.826506][T22200] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1894.833921][T22200] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1894.862172][T22200] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1894.870075][T22200] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1894.884373][T22200] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1894.895040][T22200] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1895.082546][T22200] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1895.094303][T22215] ubi0: background thread "ubi_bgt0d" started, PID 22215
[ 1895.102987][T22202] ubi0: detaching mtd0
[ 1895.109759][T22202] ubi0: mtd0 is detached
[ 1895.134915][T22207] ubi0: attaching mtd0
[ 1895.148387][T22207] ubi0: scanning is finished
[ 1895.668446][T22207] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:51:43 executing program 1:
r0 = socket$inet(0x2, 0x3, 0x2)
setsockopt$inet_int(r0, 0x1f00000000000000, 0xd1, &(0x7f0000000000), 0x4)

15:51:43 executing program 0 (fault-call:3 fault-nth:1):
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:43 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f00000002c0)=ANY=[@ANYRESOCT=r1], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
msgctl$IPC_SET(0x0, 0x1, &(0x7f0000258f88)={{0xffffffffffffffff, 0xee01}, 0x0, 0x0, 0x1, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x1000})
msgsnd(0x0, &(0x7f00000003c0)=ANY=[], 0x0, 0x2000)
msgctl$IPC_RMID(0x0, 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:43 executing program 5:
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0xff, 0x0, 0x81, 0x0, 0x5, 0x4a010, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x109002, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r1, 0xc0045009, &(0x7f0000000140)=0x1800)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x200282, 0x0)
ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x100000001)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, <r4=>0x0}, &(0x7f0000000280)=0x5)
setuid(r4)
setuid(r4)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:43 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x10, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:43 executing program 2:
syz_emit_ethernet(0xfc, &(0x7f0000000200)={@empty, @link_local, @val={@val={0x9100, 0x7}, {0x8100, 0x7, 0x1, 0x2}}, {@ipv4={0x800, @dccp={{0x14, 0x4, 0x0, 0x5, 0xe6, 0x68, 0x0, 0x1f, 0x21, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@end, @timestamp_prespec={0x44, 0x1c, 0x16, 0x3, 0x9, [{@dev={0xac, 0x14, 0x14, 0x24}, 0x1}, {@dev={0xac, 0x14, 0x14, 0x26}, 0x6d}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}]}, @timestamp={0x44, 0x8, 0xd9, 0x0, 0xb, [0x8001]}, @ra={0x94, 0x4}, @ssrr={0x89, 0x13, 0xcf, [@multicast2, @multicast2, @multicast2, @local]}]}}, {{0x4e24, 0x4e24, 0x4, 0x1, 0x2, 0x0, 0x0, 0x6, 0x1, "8ad74d", 0x3, "8b6291"}, "847f07e3fa57ecab2067614a6bb3bdde93e26b1461640bdd9e17a9ac81f91153f291a4e410f0219d7e93907534264d701661e35e2013a62895eb46f54f22e6cbe627c70f47062e261dba9c9c94122d37f91f3b046c793d4e7ab0600bcd6801bdafc7ffb2bf8e449f61eece9db0ef44f25ca3f33d0e1640da549604de70d0c0ab131c32a14ea4"}}}}}, 0x0)
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="120100003ab3f110401c3405ce63080003010902120001000000000904"], 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f)
ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000000)=0x1)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000380)=ANY=[@ANYBLOB="ff7ff09b55156afd3e70"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_read(r0, 0x0, 0x55, &(0x7f0000000080)=""/85)
r2 = gettid()
tkill(r2, 0x1004000000016)
r3 = getpgrp(r2)
ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000100)={[], 0x7, 0x2, 0x7, 0x5, 0x5, r3})
ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(0xffffffffffffffff, r4)
r5 = gettid()
tkill(r5, 0x1004000000016)
r6 = getpgid(r5)
ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000000040)=r6)

[ 1895.823419][T22239] FAULT_INJECTION: forcing a failure.
[ 1895.823419][T22239] name failslab, interval 1, probability 0, space 0, times 0
[ 1895.875776][T22239] CPU: 1 PID: 22239 Comm: syz-executor.0 Not tainted 5.8.0-rc4-syzkaller #0
[ 1895.884685][T22239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1895.894774][T22239] Call Trace:
[ 1895.898585][T22239]  dump_stack+0x18f/0x20d
[ 1895.902954][T22239]  should_fail.cold+0x5/0x14
[ 1895.907569][T22239]  should_failslab+0x5/0xf
[ 1895.912007][T22239]  kmem_cache_alloc_node_trace+0x27d/0x400
[ 1895.918043][T22239]  __kmalloc_node_track_caller+0x38/0x60
[ 1895.923697][T22239]  __alloc_skb+0xae/0x550
[ 1895.928050][T22239]  alloc_skb_with_frags+0x92/0x570
[ 1895.933185][T22239]  ? aa_label_sk_perm+0xf2/0x560
[ 1895.938153][T22239]  sock_alloc_send_pskb+0x72a/0x880
[ 1895.943734][T22239]  ? sock_wmalloc+0x120/0x120
[ 1895.948430][T22239]  ? mark_held_locks+0x9f/0xe0
[ 1895.953216][T22239]  ? do_raw_spin_lock+0x120/0x2b0
[ 1895.958264][T22239]  ? __local_bh_enable_ip+0x159/0x250
[ 1895.963661][T22239]  ? lockdep_hardirqs_on_prepare+0x3a2/0x590
[ 1895.969834][T22239]  ? j1939_sk_sendmsg+0xe81/0x1370
[ 1895.974990][T22239]  ? trace_hardirqs_on+0x5f/0x220
[ 1895.980665][T22239]  j1939_sk_sendmsg+0x6bb/0x1370
[ 1895.985646][T22239]  ? rw_copy_check_uvector+0x298/0x390
[ 1895.991697][T22239]  ? j1939_sk_release+0x790/0x790
[ 1895.996835][T22239]  ? j1939_sk_release+0x790/0x790
[ 1896.001884][T22239]  sock_sendmsg+0xcf/0x120
[ 1896.006322][T22239]  ____sys_sendmsg+0x6e8/0x810
[ 1896.011103][T22239]  ? kernel_sendmsg+0x50/0x50
[ 1896.015785][T22239]  ? do_recvmmsg+0x6d0/0x6d0
[ 1896.020388][T22239]  ? lockdep_hardirqs_on_prepare+0x590/0x590
[ 1896.026474][T22239]  ? _parse_integer+0x132/0x180
[ 1896.031357][T22239]  ? lockdep_hardirqs_on_prepare+0x590/0x590
[ 1896.037352][T22239]  ___sys_sendmsg+0xf3/0x170
[ 1896.041956][T22239]  ? sendmsg_copy_msghdr+0x160/0x160
[ 1896.047259][T22239]  ? __fget_files+0x272/0x400
[ 1896.051960][T22239]  ? lock_downgrade+0x820/0x820
[ 1896.056822][T22239]  ? find_held_lock+0x2d/0x110
[ 1896.061625][T22239]  ? ksys_write+0x212/0x250
[ 1896.066148][T22239]  ? __fget_files+0x294/0x400
[ 1896.070843][T22239]  ? __fget_light+0xea/0x280
[ 1896.075449][T22239]  __sys_sendmsg+0xe5/0x1b0
[ 1896.079965][T22239]  ? __sys_sendmsg_sock+0xb0/0xb0
[ 1896.085029][T22239]  ? do_syscall_64+0x1c/0xe0
[ 1896.089641][T22239]  ? lockdep_hardirqs_on_prepare+0x3a2/0x590
[ 1896.095661][T22239]  do_syscall_64+0x60/0xe0
[ 1896.100110][T22239]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1896.106015][T22239] RIP: 0033:0x45cba9
[ 1896.109905][T22239] Code: Bad RIP value.
[ 1896.113976][T22239] RSP: 002b:00007f87ac07ec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
15:51:43 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = gettid()
tkill(r1, 0x1004000000016)
r2 = syz_open_procfs(r1, &(0x7f0000000180)='fdinfo/4\x00')
ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f00000003c0)={0x0, 0x0, 0x6, 0x0, [], [{0x800, 0x200, 0xfffffffffffffff5, 0x4, 0x7, 0x4}, {0x6, 0x2, 0x10000, 0x80000001, 0x81, 0x9}], [[], [], [], [], [], []]})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
rmdir(&(0x7f0000000040)='./file0\x00')
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x0, 0x4800)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1896.122415][T22239] RAX: ffffffffffffffda RBX: 00000000005034c0 RCX: 000000000045cba9
[ 1896.130399][T22239] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
[ 1896.138390][T22239] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1896.146472][T22239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
[ 1896.154460][T22239] R13: 0000000000000a5f R14: 00000000004cd3be R15: 00007f87ac07f6d4
15:51:43 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x127e, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:43 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4141, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1896.350540][T16936] usb 3-1: new high-speed USB device number 8 using dummy_hcd
15:51:43 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0xa00200, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r2, 0xc0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0x20, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4}, 0x0, 0x0, &(0x7f00000003c0)={0x0, 0x7, 0x80000000, 0x6}, &(0x7f0000000400)=0x100000000, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)}}, 0x10)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r4 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r4, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r5, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r5, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000880)={r1, 0xc0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=0xfff, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x8, 0x5}, 0x0, 0x0, &(0x7f0000000600)={0x0, 0x6, 0x3, 0x8}, &(0x7f0000000640), 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=0x7}}, 0x10)

15:51:43 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4600, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1896.610961][T16936] usb 3-1: Using ep0 maxpacket: 16
[ 1896.667576][T22263] ubi0: attaching mtd0
[ 1896.689780][T22263] ubi0: scanning is finished
15:51:44 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4602, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1896.832870][T22263] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1896.847513][T22263] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1896.861350][T16936] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=63.ce
[ 1896.878884][T16936] usb 3-1: New USB device strings: Mfr=8, Product=0, SerialNumber=3
[ 1896.881552][T22263] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1896.899774][T16936] usb 3-1: Manufacturer: syz
[ 1896.911276][T16936] usb 3-1: SerialNumber: syz
[ 1896.927688][T16936] usb 3-1: config 0 descriptor??
[ 1896.948935][T22263] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1896.973703][T22263] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1896.991908][T16936] i2c-tiny-usb 3-1:0.0: version 63.ce found at bus 003 address 008
[ 1896.994339][T22263] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1897.060753][T22263] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1897.086815][T22263] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1897.123113][T22271] ubi0: background thread "ubi_bgt0d" started, PID 22271
15:51:44 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4603, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:44 executing program 1:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00')
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f00000000c0)={'batadv0\x00', <r5=>0x0})
sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x30, r3, 0x7, 0x0, 0x0, {0x2, 0x3}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1}]}, 0x30}}, 0x0)

15:51:44 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:44 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)
r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000240)={0x3, 0xffffffffffffffff, 0x1})

15:51:44 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4604, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1897.416668][T22290] ubi0: detaching mtd0
[ 1897.431171][T16936]  (null): failure reading functionality
[ 1897.470807][T16936] i2c i2c-0: failure reading functionality
[ 1897.499623][T22290] ubi0: mtd0 is detached
[ 1897.512060][T16936] i2c i2c-0: connected i2c-tiny-usb device
[ 1897.520215][T22292] ubi0: attaching mtd0
[ 1897.531268][T22292] ubi0: scanning is finished
[ 1897.618376][T22292] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1897.631658][T22292] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1897.647017][T22292] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1897.679305][T22292] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1897.699268][T22292] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1897.715750][T22292] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1897.736318][T22292] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1897.749137][T22292] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1897.783656][T22300] ubi0: background thread "ubi_bgt0d" started, PID 22300
15:51:46 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
truncate(&(0x7f0000000000)='./file0\x00', 0x300000000)
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x33d842, 0x0)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100)='devlink\x00')
sendmsg$DEVLINK_CMD_PORT_SPLIT(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0xcc, r1, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [{{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x1}}, {0x8, 0x9, 0x1}}, {{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0x9, 0x1}}, {{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0x9, 0x3}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x6}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4000000}, 0x300c4810)

[ 1898.785570][ T7635] usb 3-1: USB disconnect, device number 8
15:51:46 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = syz_open_procfs(0x0, 0x0)
getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000040)=0x1ff, &(0x7f0000000180)=0x2)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)

15:51:46 executing program 1:
clone(0x2000900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x298, 0x130, 0x0, 0x98, 0x0, 0x0, 0x200, 0x198, 0x198, 0x200, 0x198, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xe8, 0x130, 0x0, {}, [@common=@inet=@multiport={{0x50, 'multiport\x00'}}, @common=@ttl={{0x28, 'ttl\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00'}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28, 'icmp\x00'}, {0x0, "d652"}}]}, @common=@inet=@SET3={0x38, 'SET\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2f8)

15:51:46 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x2}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:46 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4605, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:46 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fd53e23d9feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868924577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x1, 0x3000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x3000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f00000002c0)={0x9, 0x7, 0x4, 0x10000, 0x0, {0x77359400}, {0x3, 0x8a46318657baa0cb, 0x1, 0x6, 0x8, 0x9, "d48fe947"}, 0x2, 0x1, @planes=&(0x7f0000000240)={0x3, 0x5, @userptr, 0x100}, 0x6b4})
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
r4 = semget$private(0x0, 0x79612d1be1944d05, 0xa7)
semctl$IPC_STAT(r4, 0x0, 0x2, &(0x7f00000003c0)=""/211)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:46 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @dev={0xac, 0x14, 0x14, 0x10}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r3}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000040)={r3, 0xfffffffe}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000000)={<r4=>r3, 0x8}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000000c0)={r4, @in={{0x2, 0x4e20, @multicast1}}, 0x7, 0x3}, &(0x7f0000000180)=0x90)

[ 1899.574596][T22335] ubi0: detaching mtd0
15:51:47 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0xa}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1899.638763][T22335] ubi0: mtd0 is detached
15:51:47 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4606, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:47 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
fcntl$getflags(r1, 0x40a)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:47 executing program 2:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
ioctl$TIOCGPTLCK(r0, 0x80045439, &(0x7f0000000000))
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)

[ 1899.807327][T22336] ubi0: attaching mtd0
15:51:47 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x2}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1899.873391][T22336] ubi0: scanning is finished
15:51:47 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4608, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1900.016459][T22365] vcan0: tx drop: invalid da for name 0x0000000000000002
15:51:47 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x8}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1900.162590][T22336] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1900.173994][T22336] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1900.186507][T22336] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1900.196093][T22336] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1900.205946][T22336] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1900.216724][T22336] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1900.227033][T22336] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1900.239687][T22376] vcan0: tx drop: invalid da for name 0x0000000000000008
[ 1900.247233][T22336] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1900.262542][T22373] ubi0: background thread "ubi_bgt0d" started, PID 22373
[ 1900.282164][T22356] ubi: mtd0 is already attached to ubi0
[ 1900.288241][T22357] ubi0: detaching mtd0
[ 1900.365586][T22357] ubi0: mtd0 is detached
[ 1900.385344][T22346] ubi0: attaching mtd0
[ 1900.390241][T22346] ubi0: scanning is finished
[ 1900.487371][T22346] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4
15:51:48 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x2f606557d60c1b8a, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="535b6fd3081b38428f0e22ae65c334289c084db1034434b971fa13"], 0x8d)
ioctl$TCSETA(r0, 0x5406, &(0x7f00000004c0)={0x40, 0x0, 0x0, 0x0, 0x0, "078cf0251c0e00"})

15:51:48 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4609, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:48 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x11}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:48 executing program 2:
syz_emit_ethernet(0x35, &(0x7f00000000c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x27, 0x0, 0x0, 0x8, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "0100"/19}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x7, @private2={0xfc, 0x2, [], 0x1}, 0x400, 0x2}, 0x20)

15:51:48 executing program 5:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x2)
syz_open_procfs(0x0, 0x0)
setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000040)={0x3c, @rand_addr=0x64010100, 0x4e24, 0x1, 'dh\x00', 0x8, 0x7, 0xf}, 0x2c)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
shmctl$IPC_RMID(0x0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$KVM_SET_IDENTITY_MAP_ADDR(r0, 0x4008ae48, &(0x7f0000000180)=0x3000)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
ioctl$UI_SET_MSCBIT(0xffffffffffffffff, 0x40045568, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000a00000000000000150000040010000000000000000000000000000000000000000000000000c67524d38f637b11624e751df2a39fb029a58e1ce0d3db1ff51512065e89ba05efffb7a704c6bcd030e5e979c6cd276a19ca4f2ee3a12f537a12c525df8b3a5be7e5f5ab211e7c2ed00e14726817889fe291c0c50cd1e0714a5aef4ef9f382843cf03f7c7eca3b16d418a27cb856cfaa393d395883afc35fdd265b4c7bc5128389c6491d13b7a5749a77b94ed156ad6f044b49e4b5d653e3517525"], &(0x7f0000000300)=""/250, 0x3a, 0xfa, 0x8}, 0x20)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:48 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x10)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1900.639939][T22389] x_tables: ip_tables: icmp match: only valid for protocol 1
[ 1900.662822][T22390] x_tables: ip_tables: icmp match: only valid for protocol 1
[ 1900.739445][T22399] vcan0: tx drop: invalid da for name 0x0000000000000011
[ 1900.792600][T22403] BPF:[1] STRUCT (anon)
15:51:48 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x460f, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1900.822167][T22403] BPF: 
[ 1900.838120][T22403] BPF:meta_left:12 meta_needed:252
[ 1900.861769][T22406] BPF:[1] STRUCT (anon)
[ 1900.867239][T22406] BPF: 
[ 1900.873478][T22403] BPF:
[ 1900.873478][T22403] 
15:51:48 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x101000, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
setsockopt$sock_void(r1, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:48 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa00080045f400180000000000d41178ac1e0001ffffff0200000000"], 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
write$FUSE_IOCTL(r0, &(0x7f0000000000)={0x20, 0x0, 0x7, {0x7, 0x0, 0x2, 0x8004}}, 0x20)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40046f41, 0x76006e)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x1)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffa000/0x4000)=nil, 0x4000})

[ 1900.901449][T22406] BPF:meta_left:12 meta_needed:252
15:51:48 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xee}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1900.947967][T22406] BPF:
[ 1900.947967][T22406] 
[ 1900.984365][T22413] ubi0: attaching mtd0
[ 1901.004096][T22413] ubi0: scanning is finished
15:51:48 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4610, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1901.115725][T22420] vcan0: tx drop: invalid da for name 0x00000000000000ee
15:51:48 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x1100}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1901.224460][T22413] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1901.243562][T22413] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1901.292142][T22413] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1901.331836][T22413] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1901.357024][T22413] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1901.387126][T22413] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1901.414339][T22439] vcan0: tx drop: invalid da for name 0x0000000000001100
[ 1901.428298][T22413] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1901.468746][T22413] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1901.504041][T22432] ubi0: background thread "ubi_bgt0d" started, PID 22432
15:51:49 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x2f606557d60c1b8a, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="535b6fd3081b38428f0e22ae65c334289c084db1034434b971fa13"], 0x8d)
ioctl$TCSETA(r0, 0x5406, &(0x7f00000004c0)={0x40, 0x0, 0x0, 0x0, 0x0, "078cf0251c0e00"})

15:51:49 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x0, 0x1)
ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000180)=0x1)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:49 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4611, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:49 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x3f00}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:49 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd18ad81feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b3950300000028fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
prctl$PR_SET_FPEMU(0xa, 0x0)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:49 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000200)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
r1 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r1, 0xffffffffffffffff, r0, 0x0)
keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000000)={r0, 0x76, 0xda}, 0x0, &(0x7f0000000080)="429dcd0628dd89f6d73f36a79f91c8c2c137f106c41398344e40ddf6342ec5486acf2c6caccef8920ef99f8ea4404f0249b9ab6cce9ef909bb51c455972e56a440d6af9b4ab138cd67a2d292a0cd7e2e2082fe34de8a938db00377f5ce51d2c94126c7951f918873aa098fe69be7a52fd9276a3158fd", &(0x7f0000000100)="9576965adcb771167be63c4e650e580adbfae7907077ed8dc0875b5fe5fb79d9debfb20edcb8ff791038aee4a77c9f5692ef59f5e9a3dc7664f6f2171a45bac9898e1fb85c59e5abc77134ea271b708fdbeea792f7fb223482c39a9bb49dbf367e34cc114cee0c05696b3bd25d459bb0f421227ac71af33852c1076d232dc62c25191b404b33006e0f01008683df9d4c4841c1a9a7a9016826f18956b4c0bc3f218fce6fdcd474398f36d1ebd69195908904895747943ee89b38760c5ac4a04a1d765adf71e3717ec060b62a4922c18a1a7dcc6e1e039b9b3a8f")

[ 1902.086302][T22458] vcan0: tx drop: invalid da for name 0x0000000000003f00
15:51:49 executing program 2:
syz_emit_ethernet(0x1e, &(0x7f0000000000)=ANY=[@ANYBLOB="4adf3050abcf7f9dacd7aaaa000c04c3002007020000bd869d1c9772ce4a2204b5dbb1cb9bd8c40300cd178cdfa096d3b9576bf7d49b5b208806448d5f80e2d2cfe98a20e65714d71e1e8e"], 0x0)

15:51:49 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4612, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1902.144970][T22455] ubi0: detaching mtd0
15:51:49 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xee00}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1902.213957][T22455] ubi0: mtd0 is detached
[ 1902.256672][T22462] ubi0: attaching mtd0
[ 1902.261722][T22462] ubi0: scanning is finished
15:51:49 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4615, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1902.387073][T22462] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1902.395663][T22472] vcan0: tx drop: invalid da for name 0x000000000000ee00
[ 1902.416418][T22462] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
15:51:49 executing program 2:
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001140)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3019c13bd2321afb56fa54f26fb0b71d0e6adfefcf1d8f7faf75e0f226bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ceb9fbfbf9b0a4def23d410f6296b32a83438810720a159cda9036b4e369a9e152ddcc7b1b85f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa00000058138d3d0000000000000000000000000000000000020000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f7da31cf41aabbdd343fbfff4583d06c91fd6b11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec309baed0495f06d058a73650d6fe048ba6866adebab53168770a71ad901ace383e41d277b10392a912ffaf6f658f3f9cd16286744f83a83f128f8f92ef992239eafce5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cefd4a2b94c07bd5d4aa10aed8477dfa8ceefb467f05c6977c78cdbf37704ec73755539280b064bda144910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06dddeb61799257ab55ff413c86ba9af34c270246c878d01160e6c07bf6cf8809c3a0d462357b22515567230ad1e1f4933545fe2c741374211663f6b63b1dd044dd0a2768e825972ea3b77641467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cc1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc20f49e298727340e87cdefb40e56e9cfad973347d0de7ba4754ff231a1b933d8f931ba3552b2c7c503f3d0e7ab0e958ad0700822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2af79b8d4c2bf0f7a2cb032dad13007b82e6044f643fc8cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942e367f603e3856a346cf7f9fe0bc9f2a1a7506d35e5eb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814458a8125df532d87cb04c0174326d2c0002dc79bb7a51ccb589d075d2e5028fffddb88967c2eb6daf68537d7593372a3418e1edc418f22d1c66023f1d937d41553e1501cd55b91dc02097f3c94de004a3d49d7bdfdf3ec2a0b698a360832907a6ff63efde66226aef551262e1ff2be49db88f4d2718cef246eef210db85bcc1e1d6ecc1c51b538d352e6c1d55a0266ad1d0d561d837d000000000000"], &(0x7f0000000140)='GPL\x00'}, 0x48)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r0, 0xc0, &(0x7f0000000b00)={0x0, <r1=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={r1}, 0xc)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={r1}, 0xc)
syz_emit_ethernet(0x26, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000ef0800450000180000000000739078ac1e0001ffffffff03000000eb598df2f659cc4aaae9db18bd4b7ae55b85f483b034bca0da697babfb7befac8dd635fd6c2af2966cd10984b3b431501d5e7967ac54b76b7697aeb425fd027e223adc246b9586289be5f9d528d4636ea4b8751953f7221c3b710b694acd573de49183d8eee27ee58ce4618f404966e5a43e63a89c61445d690365fecaf0afca98a3969654180ed2c847866e"], 0x0)

15:51:49 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xefff}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1902.458080][T22462] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1902.510752][T22462] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1902.546017][T22462] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1902.580615][T22462] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1902.617409][T22462] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1902.655304][T22485] vcan0: tx drop: invalid da for name 0x000000000000efff
[ 1902.656632][T22462] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1902.724031][T22473] ubi0: background thread "ubi_bgt0d" started, PID 22473
15:51:50 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x2f606557d60c1b8a, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="535b6fd3081b38428f0e22ae65c334289c084db1034434b971fa13"], 0x8d)
ioctl$TCSETA(r0, 0x5406, &(0x7f00000004c0)={0x40, 0x0, 0x0, 0x0, 0x0, "078cf0251c0e00"})

15:51:50 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4619, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:50 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = getgid()
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, <r5=>0x0}, &(0x7f0000000080)=0xc)
r6 = add_key(&(0x7f0000000200)='user\x00', &(0x7f0000000240)={'syz', 0x0}, &(0x7f00000002c0)='4', 0xba, 0xfffffffffffffffe)
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, <r8=>0x0}, &(0x7f0000000400)=0xc)
keyctl$chown(0x4, r6, 0x0, r8)
setresgid(r0, r5, r8)

15:51:50 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xffef}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:50 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
socket$qrtr(0x2a, 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

15:51:50 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x2205, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
ioctl$SNDRV_PCM_IOCTL_DROP(r1, 0x4143, 0x0)

[ 1903.496214][T22508] vcan0: tx drop: invalid da for name 0x000000000000ffef
15:51:50 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4650, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:51 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x34000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1903.655204][T22518] ubi: mtd0 is already attached to ubi0
15:51:51 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=<r0=>0x0)
waitid(0x1, r0, &(0x7f0000000080), 0x2, &(0x7f0000000100))

15:51:51 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2}, 0x0, 0x4000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:51 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4c01, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1903.793769][T22529] vcan0: tx drop: invalid da for name 0x0000000000034000
15:51:51 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000240), &(0x7f00000002c0)=0x4)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r3 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r3, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1903.913123][T22535] ubi0: detaching mtd0
[ 1903.936314][T22535] ubi0: mtd0 is detached
[ 1904.185159][T22547] ubi0: attaching mtd0
[ 1904.189986][T22547] ubi0: scanning is finished
[ 1904.330686][T22547] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1904.358598][T22547] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1904.389047][T22547] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1904.396304][T22547] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1904.424253][T22547] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1904.444533][T22547] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1904.470986][T22547] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1904.501429][T22547] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1904.533102][T22552] ubi0: background thread "ubi_bgt0d" started, PID 22552
15:51:53 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x2f606557d60c1b8a, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="535b6fd3081b38428f0e22ae65c334289c084db1034434b971fa13"], 0x8d)
ioctl$TCSETA(r0, 0x5406, &(0x7f00000004c0)={0x40, 0x0, 0x0, 0x0, 0x0, "078cf0251c0e00"})

15:51:53 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x3ffff}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:53 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x541b, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:53 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x5}, 0x0, 0x3, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = syz_open_procfs(0x0, 0x0)
read$qrtrtun(r1, &(0x7f0000000040)=""/59, 0x3b)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000700)=0x1b, 0x4)
openat$md(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/md0\x00', 0x2, 0x0)
syz_usb_connect$uac1(0x6, 0xd2, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc0, 0x3, 0x1, 0x38, 0x10, 0x9, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7}, [@output_terminal={0x9, 0x24, 0x3, 0x3, 0x301, 0x1, 0x3, 0x3f}, @output_terminal={0x9, 0x24, 0x3, 0x4, 0x101, 0x2, 0x4, 0x6}, @output_terminal={0x9, 0x24, 0x3, 0x1, 0x0, 0x5, 0x2, 0x40}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x106, 0x6, 0x5, 0xc9}, @processing_unit={0xc, 0x24, 0x7, 0x6, 0x6, 0x5, "e22ddbb286"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x8, 0x3, 0x81, 0x1, "b891", "8783"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x6, 0x2, 0x4, 0x6, "f6a3"}, @format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0xf7, 0x3, 0x6, 0x6, "80a1849b1b73a34b"}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x40, 0x20, 0x0, {0x7, 0x25, 0x1, 0x2, 0x81, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x3, 0x4, 0x7, 0x3, "3083", 'U'}]}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0xc0, 0x56, 0x1, {0x7, 0x25, 0x1, 0x2, 0x99, 0xcc}}}}}}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x200, 0x40, 0xff, 0x80, 0x8, 0xcc}, 0x5, &(0x7f00000002c0)={0x5, 0xf, 0x5}, 0x6, [{0x40, &(0x7f0000000300)=@string={0x40, 0x3, "a1783fa35e57b38fd0cf693a7303d2dab4d874a4db40425056bec5cebe70a5491a8b2eed3e9fd924aa7243bd00cc4993805c57a9466d136670eb47ca0173"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1007}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x801}}, {0xff, &(0x7f0000000440)=@string={0xff, 0x3, "d6b1e1dc27261954da4db9f914cc65e048440a8457564727ad78167673cf2e83c86de074f00c35c1199a6bb952546c4f701f937fd2c65e6bd3b66a395f49bf6eb18c87fb1b663f2b17e53a973a818f7bf17a0d23c7f916f21039ef884c05167a80a16c77846418686c5b7b730eeb11fec4f886ab3bde22d46ecad51a452e8af342d72740a24c4b5cdcde53ba84c8a0d22a4fbb281b79b32ababc97772c6c5a964955ef595452a496a060e52d0bce10be80968b877bfac377265c2031fffb9aeb124e84fa23eb829ef77c719937294dfc91bd9f0cb5bf09e1633d5ec19a8021a0bbdd4406edfe63133c4fbcb828161bc8e9a12303ecb52a1cb8ee4f5029"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x21}}, {0x88, &(0x7f0000000580)=@string={0x88, 0x3, "6fc5a0d3ce7a4592fecf149d4d2a923cd5210800b91402cdfef725ca30130505c018df09c14bbafe13923cd5c592b886757564babb45b13c8e8254307258576fa3d3f523a7939f3ddcabebfcfc92ffa83f3a9d611c05bbdb3dbc47dd1b78b24644c8af0d50ea5bc269bf61846a0f638f041828daaa366ab44ea6bd87956c317c501e982e3270"}}]})
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:51:53 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x6, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9dbafdc0a00e9bfde03afe9c81a9cf05725caf1cae63587ff7f0000cde5c019080096e2c43f6b8fd41b7e7666ada01543b7185a4650732b48588a84f8347a1b5efd079137038277beb5e0615c40dbb7005fbd189981feb0a514c168646ea716bb5b94bd00009b4f22389c753acb8026fd80aec7d848362f9a78d7516f8f25bfc91c15d7dc2adcdefba0868942577d8953191eeb79379829652b10737d4e25a22695df1cff25340af4fc990000099fff70b24f8228bd07741c710ebde4bf17dc8f3259ec78e5b39515991b1428fa"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
write$P9_RLOCK(r0, &(0x7f0000000240)={0x8, 0x35, 0x2}, 0x8)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x0, 0x0)
r2 = openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$cgroup_freezer_state(r2, &(0x7f0000000280)='freezer.state\x00', 0x2, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x40186f40, 0x76006e)
ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], 0x1, 0x8})
splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x2000, 0x0)

[ 1905.744944][T22564] ubi0: detaching mtd0
[ 1905.750139][T22566] vcan0: tx drop: invalid da for name 0x000000000003ffff
[ 1905.772067][T22564] ubi0: mtd0 is detached
15:51:53 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x400300}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:53 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x5421, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1905.928411][T22572] ubi0: attaching mtd0
[ 1905.958324][T22572] ubi0: scanning is finished
[ 1905.990331][T22575] vcan0: tx drop: invalid da for name 0x0000000000400300
15:51:53 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x5423, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:53 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xee0000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1906.065327][T22572] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1906.099087][T22572] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1906.124963][T22572] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1906.145954][T22572] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1906.185258][T22572] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1906.224133][T22572] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1906.233801][T22587] vcan0: tx drop: invalid da for name 0x0000000000ee0000
15:51:53 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x5450, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1906.283890][T22572] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1906.320386][T22572] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
15:51:53 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x1000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1906.358079][T22581] ubi0: background thread "ubi_bgt0d" started, PID 22581
15:51:53 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x190402, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000002840)=[{&(0x7f00000003c0)=""/104, 0x68}, {&(0x7f0000000440)=""/229, 0xe5}, {&(0x7f0000000540)=""/219, 0xdb}, {&(0x7f0000000640)=""/160, 0xa0}, {&(0x7f0000000700)=""/4096, 0x1000}, {&(0x7f00000028c0)=""/39, 0x27}, {&(0x7f0000001740)=""/195, 0xc3}, {&(0x7f0000001840)=""/4096, 0x1000}], 0x8, 0x0)
syz_open_procfs(0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40186f40, 0x76006e)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$SG_SET_TIMEOUT(0xffffffffffffffff, 0x2201, &(0x7f0000000300)=0x4)
sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x140f, 0x100, 0x70bd26, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x7, 0x45, 'cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'ib_srpt\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004811}, 0x4000080)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
getsockname$l2tp6(r2, &(0x7f0000000280)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000002c0)=0x20)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1906.473474][T22597] vcan0: tx drop: invalid da for name 0x0000000001000000
[ 1906.658539][T22602] ubi0: detaching mtd0
[ 1906.698170][T22602] ubi0: mtd0 is detached
15:51:56 executing program 1:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000300)="6653070000053c27bc3376003639405cb4aed1736b533f9e1623a7cf73af21532ad62f0000001500ae47a825d8680000805acf4f8f36460000000079aed75d492b415bcee00a06dc9d8e99ad2f81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0b16d86a6a402ce783aa5bfb89e6f2c64884b3c5d052563def19f8b1200eaf284126422d8a4d302e96ea0cdfe02eaf9b66be609c68408e2b060e50b77b0e8d4c2e631205c", 0xa7}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
tkill(r0, 0x3c)
sched_setattr(0x0, 0x0, 0x0)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x20, r0, 0x0, 0x0)

15:51:56 executing program 3:
syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000140)="eb3c906d6b66732e666174000204010002000270fff8f2", 0x17}], 0x200c010, 0x0)
r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0)

15:51:56 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x5451, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:56 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x2000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:56 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
shmctl$SHM_STAT(r1, 0xd, &(0x7f0000000180)=""/235)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1909.087842][T22620] vcan0: tx drop: invalid da for name 0x0000000002000000
15:51:56 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x5452, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:51:56 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x8000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:56 executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa, 0x1, 'vxcan\x00'}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x0)

15:51:56 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x282800, 0x0)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000080)={<r2=>0x0, 0x0, 0x7})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f00000000c0)={r2, 0x0, 0x2b})

15:51:56 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x5460, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1909.399705][T22632] vcan0: tx drop: invalid da for name 0x0000000008000000
15:51:56 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x11000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:51:56 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)

[ 1909.532447][T22640] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
[ 1909.659455][T22646] bond5: (slave vxcan5): The slave device specified does not support setting the MAC address
[ 1909.684752][T22681] vcan0: tx drop: invalid da for name 0x0000000011000000
[ 1909.801767][T22646] bond5: (slave vxcan5): Error -22 calling dev_set_mtu
[ 1909.932431][T22646] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
15:52:00 executing program 1:
signalfd(0xffffffffffffffff, &(0x7f0000000040), 0x8)

15:52:00 executing program 2:
syz_emit_ethernet(0x5a, &(0x7f0000000000)={@remote, @empty, @val={@void, {0x8100, 0x0, 0x1}}, {@canfd={0xd, {{0x0, 0x1, 0x0, 0x1}, 0x35, 0x1, 0x0, 0x0, "451d042644a3a3a8ef722f04947353a00923d4105bb640714bdbcbd74f7d8d7b4c4b9d0993f95b6de36377fa3cd7cb3f0d79ab0e5ce9cee15067cf7169f5919a"}}}}, 0x0)
r0 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, 0x0, 0x0)
ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0xffffffffffffffff)

15:52:00 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x5600, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:00 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x3f000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:00 executing program 5:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = syz_open_procfs(0x0, 0x0)
io_setup(0xa, &(0x7f0000000080)=<r2=>0x0)
r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
io_submit(r2, 0x1, &(0x7f0000000200)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000100)="e0", 0x1}])
r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r4, 0x40046f41, 0x76006e)
io_cancel(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x81, r1, &(0x7f0000000040)="0e266ddf05b1d7be6eb9314d8feb2ad299e836907f7268949b3b562cf097de94f11efedeb3d68133c66ddfa0f882c2aabaf8", 0x32, 0x7, 0x0, 0x0, r4}, &(0x7f00000001c0))
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000240)='./file1\x00', 0x1d8)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:00 executing program 3:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r3 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa, 0x1, 'vxcan\x00'}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x0)

15:52:00 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000080)={0x4, &(0x7f0000000000)=[{0xff, 0x7, 0x1, 0x2}, {0x28, 0x6, 0x2, 0x5}, {0x5, 0x18, 0x3f, 0x2}, {0x7b7, 0x81, 0x32, 0x8}]})
accept4$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000140)=0x1c, 0x80800)
openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0xa00, 0x0)

[ 1912.992041][T22714] vcan0: tx drop: invalid da for name 0x000000003f000000
[ 1913.014829][T22715] netlink: 'syz-executor.3': attribute type 1 has an invalid length.
15:52:00 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xfdffffff}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:00 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x6364, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:00 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
r5 = dup2(r1, r4)
setsockopt$sock_void(r5, 0x1, 0x1b, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(0xffffffffffffffff, 0xc004ae02, &(0x7f0000000040)={0x1, [0x0]})
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1913.216319][T22749] vcan0: tx drop: invalid da for name 0x00000000fdffffff
15:52:00 executing program 3:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = open(0x0, 0x103042, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800006, 0x10, r0, 0x0)
ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0)
read(0xffffffffffffffff, &(0x7f0000000180)=""/19, 0xfffffe47)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x3)

15:52:00 executing program 2:
prctl$PR_SET_FP_MODE(0x2d, 0x2)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = dup2(0xffffffffffffffff, r0)
ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000000))
syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="0500000000000000000800450000180000000000739078ac1e0201ffffffff03000000000000"], 0x0)

15:52:02 executing program 1:
r0 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x68001)
ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000000)={0x23, 0x3, 0x10, 0x0, 0x0, 0x0, 0x0})
ioctl$USBDEVFS_SUBMITURB(r0, 0x5514, 0x0)
close(r0)

15:52:02 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xffef0000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:02 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x7010, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:02 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x3, &(0x7f00000003c0)=ANY=[@ANYRES32=r1, @ANYRESOCT=0x0, @ANYBLOB="f7b49948fc3fe23af9b5c1f6b7101365f65aab7f47734ad8d355653e3c2a4b59b530dadf09eb10bfbcf4a2bd56ff29a844efc5975e4c07cbed0fefa3931701d404319bf538030543912708b63c9864b5d136fdb0b77d70b504453eca29f205a086330828478275102c59", @ANYRESHEX, @ANYRES32=r5, @ANYBLOB="7e05cca4370c7b7ed275f9d609dc60a7b289d97eb35d617906c6ff865b94b10805f1cd1366f4eed489aaa6e6a6338d248e226ef69d2c91e59eb276541c12d40ef0fb65d89a01a6679efd1161b7c69ee3664a770279697d20aee4b636f9cdd84014845b6c5ffba2af8bbfa936fa1f43f78d33f4c016df951e43fde7", @ANYRES32], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x4, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:02 executing program 2:
syz_emit_ethernet(0x62, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x14, 0x4, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x4, 0x0}, @broadcast, {[@generic={0x7, 0x5, "bc5734"}, @rr={0x7, 0x17, 0x39, [@private=0x305, @rand_addr=0x64010100, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x27}]}, @timestamp={0x44, 0x1c, 0x9a, 0x0, 0x4, [0x6d, 0x4, 0x2, 0x7fff, 0x22, 0x1]}, @ra={0x94, 0x4}]}}, "03000000"}}}}, 0x0)

15:52:02 executing program 3:
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r0 = open(0x0, 0x103042, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800006, 0x10, r0, 0x0)
ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0)
read(0xffffffffffffffff, &(0x7f0000000180)=""/19, 0xfffffe47)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x3)

[ 1915.051073][T22819] vcan0: tx drop: invalid da for name 0x00000000ffef0000
15:52:02 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x8912, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:02 executing program 2:
syz_emit_ethernet(0x1e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa3c00f8c47f61247b29795dddc6073308c232db000c020001000202000002f9c4c3587ed28a"], 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0xfffffff7, [0xd85, 0x9], 0x4}, 0x10)

15:52:02 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xffff0300}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1915.335410][T22838] vcan0: tx drop: invalid da for name 0x00000000ffff0300
15:52:02 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000003240)=ANY=[@ANYBLOB="aa00783e52ceed156aa92ddcd613ac1e0001e000000203000000000000000000001000000000f2a0eeaf4668483d7aaa20b946b37d02dde5cd85249dc0779334f1fae648b76ce277385a77ed2585213476fb370fc9d57fca61d794ce1a8a71287c149ce6caf04ceebd2792af59f680708ab19651b92dc581568519f47806d073996df47559e4873bd19e660176eae63de6ccdf5d1feeed724053ac9f5880b3f7e6f3743fb335ecff3153549b6da043f8e5827f4e6b31a143378820efd09f61189da8fe0d0300000044e0eb2327ab0945841ee5e74adc66170e6981ae85fb86ca1d8d94b192f93c4e2626d3b6841a095f8f03a5"], 0x0)
r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x301100)
ioctl$VIDIOC_G_CTRL(0xffffffffffffffff, 0xc008561b, &(0x7f0000000040)={0x80000001, 0x8})
ioctl$SNDRV_PCM_IOCTL_WRITEN_FRAMES(r0, 0x40184152, &(0x7f0000003200)={0x0, &(0x7f00000031c0)=[&(0x7f0000000080)="1ba663d6cb5639068b473a83fc47968d68e2fac1c76c786de3bea9539beedac5f9dd1c3bb494748a85d0905e572305e2d3db88369cbf1a3ff0ba1f6e87afbf829dce80e6dd2b0196bad3454b1af34b0d23a0baad39afc78b0ec5753a852bae76c08b12b2cd317898f3c1f4e1387087743e52588fddd89b779b1ea64bd531b53a2ce3dfa11a1a322a7f60b9cf5426f972a95a1bb774aa06f669363ccb02f9e1b20d5a85380113039c0c73cc9f9d368d6e2f1e3043f253ec209f25334d65234048cc9ea64fdec95dc00b98b518751a729ac19c71a5d3bee579a36b7073314f92f0b0b43422c72326af4310ef87def581ba9d30682012b4e86f4ab3e0a0d4959cd3f659065bec3553bbffb4e9e70858dafdec05bdd7a3d3428544c8028f21837e32acceffd8ce872a94675999be1b8a5d03a190d9708c83998860aa5ba4a18a55ee4c9b9d05cd57d0956707334a8176599420a83f85e12c824732bd8f12c2468e6206acd8f47346db7557ea7f9b0db537905c6d8fa95d31ffe3edbb96010faff33e17d6a56b54314c9f93043dde7b72216eb004aecef10b72cc9f69c798d4690854710b48d654f5b3cdbce307d5d6938897ac09aec600bc17db6f0ce750ca09373689c01e04e8ef43dffffe5445077478596277fc2e7aa4bc371548e2dc42e5a68d093b0d31dbfe65029862d5f0506683bcb95e59f5a0b06fb0b5e8006b310554d56287fa82efffb595b4cab260b15dd721543487c43ab492a55b28a10d27f21b99abbbee615a2b47ced48cd9ee8ac2d97a29e1d0de092fa6b37484450bbcf9f9cc73e7d967b4c4a6fed8d67355f0fe3c8e06982c3770f825e7897aa578c721ee753a847f0adc1a330e8f6d418c5958d4f645016d9f60ecb3bf33013e1b89e77b316e79a8443ed2bc84b47e1aed241491c61a9f0d412b6e703c5ab272c58e3bf4be3d31ea8cfaf3a12ca0e4b5e18b20762cf42cb982851b81c292321d8d0185094822bfbb7cf778550b9d63ee1fc1517e7688e14ffbdd8366dffda6492976bdafa53c41191648adce3b98cf1836033c5850e725f381dce2f4ce38d42dd7ea311890163e965b08a44c7b2381879da1be7484f492cbecd6db1f54bbe8181783f2a6a4c0fa83668e98749d3e11401728998cdc361c60c21f40a4ea3a45ff0b3e1cb3892e5e04980230dfeac4630b24013db496fddc07eb1c9d33f1b1b97647ea8dd133e80df3196cc4b3259c7361add1a21fda7af75b22de1f9f77d791fd620fd88b80c545da3c268b801a19ccc05aa6e6eb1cc247e935c8d75b1c2f0f22bc787a03de62b8a5db99fb04d7438dfdf43be7d015677db7ccb87c3bd4ea2ff777281a827dd9cc202cc86190d9ac11cd2b43381566b6b26919aef75c42c63364fdcfb490964d2d4ca42d2923f9e43b84c59c982b60a9eb100b22bb7a6ea45f67eca00b90c95c30fb477790b0b0b140aa046b72c8c59ac50597172080bc880bd252a6d9f4fd451297b3db1aba1f530f2d1f8cfc4b081bbc29fe0a4ad08ae520ee83fcce269618434e3cc084423c4d0f365071c2d86ce78853a54871e094d2c4cf3d2a5613171df75ff7ebd133e8bb631a28a5c2ae26686fd12ecefe690f4d3e80889fec3bca966859b64d25ed7403b17f8725e853b5629624e46bcd3ff49f5ed87c549fb35f049baf9efa6fd534f2a26513bab50909768fef16d3bee38d52e806c515295c0b9ae78794e6eb8aca412cbb51d0fc11c87f476c81187b21c4daeb2d5713be6a83df5ff6a7ec6a7c10c0e1218912607aaa355a6f77129d657dac570012019157699294770afec4e71b535a41f30d173885f615b38163f95242e2cfcdab8974bbeb845642fd106c2b1d20762a93a3254f7cde950e743642fab8c59d39a4dc3ba1874a35d372acd9866859fe56f1bf551f0dbb0bc52a1fb5537b117be720818a53efab7ee35c4a95ed04155a6170fb9edb07a9e9e436d20b25eed0d37b9e1b4b666e20ebd660c6429ba7218e55a8212cc971e7f62a78f6f21027ba03bcbea4d8728113662e26154ab70358ab82d9ba0836b03b0c87cb3b2d6086ee69e950a08be8f1166aa85cda87e38000b496d7673404d603f50966b38563625b3f8ecb2a5c7dd60d5a83920c99963a909b45d33dfeda2ccbc895bf7f4787ab20e39d9904163fdc62db3509731775a90ba94b3cfad1a6bfe6496130873a98d24a4ad26a0d8f94115216427be3f4d2ff54b0fa10e49fdb729ded6ff1f46caff2518574fa4733bb9caa2b393c9d593bdef34963d63d089b4b725b41f52d27482bc8c1ebf6fc501f7b3eb7533dbacf6604bbbc8052924a4fedb5b015fa7dca52750fe7ac084aef9c201a419cc0508d2a79fefef3079a6654822b4aeae0ab96cd81c80f11527748c2e2b53533ebfd382e5d37f0532e807c455a09670c7798f5df8ac728e8ac30ce1f54a79a03739c6e161cea08928e124eb15061e898765a449731be813d36c4a2ff9a3f5cab578ba1fa6613dbc6b4b47d11df6c313fef604b8e359969179972f15ddfc87a668f2e557c7a4d86f7574f0d20b56b52f109c756a5c792116e606656dc40a66ede471b1204dafe069ca3661f581458be975bf704b8adea81070dce4f23bad194955c5b717d70d3720e875bc1def1f71aa34cd902d7e735f45c656794712de0ea653fb915429b8509b4f80d34d51591f139b6360d1149d4896809c74e36d443f7ad2567a8e772eb3a7a502d9a6c7bb529b5d2024a46ef1638a3cf433cee9fb7febc97ba31fe26801e00d1a797557eed7a5f52a150b440d91e10d5b8d36bf0d8ecc3560c85faf5e42998e34b0bd5c93d8cd0d67ec25de7ef65a6adda78bdd23c37495eb9f6ecb8bf132a5e628e14e6916ad4a1499bc9b469cf996a8d26fe25469b58543a174ee6e11b43d2a2a8a198eb4f46a2bd8fdc6ae337d697e337fe361f14aecc90abd6a67b28e9d6956a2ddf36afd491cd7e7460198dd2c6ffe4f5666fdb51a4f48d3f49483055450ca97bee83665414a4e21c9e54710c129d9a9e41cc2d2316634face291803056360e545777411aed7a51e78de65773c288a245272cd36d1cab080c66f9cf994ca9a2c0d4c2b3e8a292179b39f76034c284e83617a7ef65532c3e283a39790ee0d8de8761faf8f3eabe025dc6e76b15fd21c612943541b71a2207556ffc5970a32007c021a1eee740205efa09dc9131e3d3e82bf00ad94c2163a83c5ce5e36c40132efae81d2718f5f48678b4c8d165a2a62570c91bc455d2da78f900a5bcfd1ae7d280088c5212f04919a1160ec9c873a0c2fc4933efc2e310d3abc67275c5e8e69588601fb88b081027dd9527b85ead7894056c3ce2075f33c7e5873be041864310c46298aecab1f083c3d8b260cac73669894368eaf68269205d6a244bc85b20bd500a93be36eb6d08173ef300e197ad134efac6558836ff7e2ce69382fadae2e0b79ee5c42e652163b6f7e701dc689bcc5d9169570f44130f876fab06e78f8362d92e324a3b3f5603265e2e95de76744a0c684b6038adff009ee2d09c632231f6dca3866ef8ee27335129f8646338f256db03184f134fe908d1e64357e15e7d3f63e119c0ab4e6ca997529488b3af7c02ceb2e7d9bfd227f3adf8d3c8a20d39fca35e447b17f7228eb8d21eb691b5ee53c359f450a91f76440e863fa7ad147e768c3ad504c540a56eba9b2b18229f61a367c597681644fffce09ca85217c13b8d7a96d7118350fbfc7c4e57d54bcead42360bfef00204c83f6aa4f4f5326d70d7027493af8db311458a40a1fae2ab931ff46f1e418ac69744ae9266dcd67701dbf385aa9ae756b573de46736648f9bfd7462679366823f260acff283c46e81117bae1f8bd6cb32730addce0b819852a22a3a65b56619f8e02e5b7df5fec1584c9a184a9654db2ffe78e843a445febc5771d0877f48aa3f734994af892b10cdbb22a9db701f1a6668541c94678196547b4570ad07e14d88c94e4d1cca3688b8e0463c8aadbc37dd584ba9563e8c5c3d34c91d99ffc9639ff77feb42b8f5ab1bdae746447dc91ca7d704deb17708b80fcaa669713212629e9e2caa07e985936ce5b8c84edb05d0bcb78b1a86e0ef5bee7ac57965b2de35ec8f4fc220b54ef32a12d4ac25d10e14c1d6a55796ebc69d22f6d20366455929e87bd0cfcb666e3c9401c7f1327a94a9aed74d9d64bc58a4f0c06483067b1fa1b1e9afb1a26b5ec8c0a833adfd543e859a7b6385f5ff2047d529b5a23ccee3fd6d3849ad127a81439427a2c37649142cfa8a540d9b7c1f69929d2c368da329c4d312bcd2107341e41cc7c1502cca659ac06ad2c814bd5fa4dd8394494f5c64505b5eef4edd02d089dc821e289550cbd6adbb3f31266aa19ddd59b6caf28e388c37e73668a32c70af7bab0f0184897eabe6c50a1f7188ec74c0899b28db35b2b7bd24f579143f9cf08c0608c7f57bf7092d381345f283148d6389c0e735eac8384fe78708470101b2ebb8b0a9b11722406ed80c71bd99d0add8664873f13072f57902bf095201cd1e849bba7f53b2996380c41583714d906446ca8e2177c3eee4a97cd1182296387c6dc869d1f41eb01f6179be952ef71849ace408e38cfd748b198115b2c5592607554550fedd259a2511c5dc53bcc0a54a85937e94a79ee57d9135738a7b68d38f8741d586d02c18851c010714188502ede1913a38f3935ca4c0cb3ac54be92be0c64931a3c5161796d3563cad4a6e9b232bf6cc83edfb6ac4b6dc16ad27253c09da6771f1615769687aa0cf8a0ce91b3d06fd7b8670cd23ae1f2069b9a89ca9aa3ff3337698ea501920014189d095d5e17bc186a5cfe6c97fd27b752000291bcd6da9c64b84e222a5908b80dd46c36d4ef7b4d64a998a8ab237deb35f2aa334fc78cfac9ce1ba5d1adc8de160706ac9cce92af52bb1761527f1ad6e1d6d06d0fd5a0f92dcfc7da49b9c248767f901e216e72331df84c2449caea14bdf5a7dfa426c81803ec49b124651bee8ac9e9be648fe3758b744365f7290e285a7ba2b0d395c4d84b11f4c389454eed2e836d41dd44ffbc4dbf1ffddda7ebbc2a97f775dc396154f278d2218e710244120c47c30f11a7bfb6e72b91384df1d035f27dba23f5aceba32ccf218554f1ad9b229368ece9706adff948b1c3c7b2782e00d5edd37f4d84da850e667f408f1f87e66f841773dc43c72c30d4abb781f501e8cb12fa27399fa1c069bbd672b01ac9b8ab1c6e9271474b8d9cd7e5a9cd6f43409c772e8e9f6b65ac41836617731fe24e80727f58603f877d294721a3fc206f5900d6b45d2e1f2faa7a87f325004e350a0818444871ae6c8b7c4b5f483232cce790ab4dddf97dcf2f6a702a364bb22f9692b1bd2a8b4f5817f47809b4910c83abe5baa6ad4b8b6bc79dda9d046a67606e54a9f5403da7efc850e30e20135f6f57e7f407b9cb9cdc8faa21f3f442d50e1a097c0fab7af08cc2501bd327825d71689ea7386466b7ad8941cde254abb60b02fdd1637c2d96361c1b27fb99ac295551b0cc616107c8d8e2bbd10284d824bab65004cbed93f01314bad8b28bf43c7346792d917b06f780188eaa41e01a4ccaa8d27e44ba9301dd8176150743341aed3b0b6bba150a915d6004325e90b5c51012d24f479d6558d3727f7b65591e0fb96c181b167e8b97a916232ada21b815be79b65fed7175997c2d1611841adc524f389bc5ee1ee4d667bbaea6a468014007381d649bc82a5e2668d71594a82280a4dacae2784a25541d74bcc526d292a8148a578289395d9d4682", &(0x7f0000001080)="b7da4c3e30dc647e95396b76b7a2999cd06989dfff7608627aede89528b4f4ebde0800cab5f9aea2d7c47dddd6747480ee150c275b2603371cdaf22bf1ee39f6f17d0532aeb2d167285578a82be0a56d4986daadc2928d10601e5588f7e09878ee4002bcb22c2d3e2d418569e6354949b5d00748bb09893e383bbddeabaac6f733b0503e4763f674f0a6372eada2fc6af8f1cf3d80a4f8552b80e98aa611c7f91109e4c6e500a5cf952240dde1d8febcf478a6f528f12f8ff2c252c4d9ebcee15b17bafe898bb18727101759e5e9ed843535a60bfa550a5760662f640392944f71d84480a3af4cf23a34900a68eb3d2d08c805ce254c493ad989acd247bbdd6922f3020215600be0b7588c48c00a1c155a061056464920acef44a6f7f30202e2cf0335706fabc3e65bf7bc17ff99de2b369038965d67b6d82d261c95d14e7e2912fb99b70c16cdb182a745b9c9cb8c3d6158dd748757a711a5cf4540f80eeec680a9f63294b69a46dcfcfae43218d38dbbc34f1cc62e3bd9b81ece48ba010970cc13426fe66242eda5f0e8471f798c1ba3eabc523c19c673a187dd544ad49e9616224621ed4c055a5df458cc4678144bd135c49b17eacc926385365498ba8b8ab030ecec6f5682ab95e9426b52832caffca7e162d008cf6b1b28ee98d0faf030b84f22e21766102061f1c38f6836f0240536e85752f3f7e9589307028ae350964c178172e64162c8c57133c3f57196ff2138b17bb9754e7d5551d4ba5fd28f37f1ad5549f20b383f90c6ac61a599a66ae30f0a6e8ed3478c11ba1e24ef152d874db73512603fdf00fd82449051977450bcba0f230e8f9f060e20eec8e2b8254417ad970e50ebd53d4a1046fce392abbf2f0a88f6a89d191533c49223982604b296bb8e041674d0129d35fca4bc2f82f786d93a9d96e9995ec7971cd936586f7e98a81c6a040d80eec81a2f0835ef41e71df0cf09b47a5d6679b27c50acdef0028cd4f176c74428fad4e9ef1d8ae204405bb878a7f6f895bbe653c8ee15197b605f4ce628c5c77cc01253569b3bcd64e922878da38610bb3ba04b7c6aa1302f012eeafdce57f8c38c0c9871e9db899f440ff20daa6316d0558b18350caec353f117db363b066afc758d6daabaa34c56c46c98b9509efc6398a5bf2ab0f439e91743278fae1edac681c0a2c4860f2c43365053855a5faa79b98aaa548b4c2f009743bebd24831a6f565f9b68afd2fece804a2804dd577197c582f10739ffe6747ac2657bf7a26b83750cf0dc91bc77513b43ce51eb6bcd4dfd39bacbcef33a5895f3209047b3639a1b060d50e5a5c296d1d7761ca3c2ab1e25be0d5b281723b5c290132263bf4ec139637496af69806babc6dbf1b7a4031ee018a231aa1f9352d0539d275e0a38e63aabcf9ae868a2341e4a1c9e22428c3a1e48efa7a06fd9637b0b68a97af08c6b1830f818c2e2b57b0137f28614b8238b261242ed0aa366135075fbdf7c01e5c2663fce848890db725099f83d0743d6d6189d7c057bb5937d0e148f7ad1b6ae1cc58a694f93e6e55eef4e2b7ee2a216c41f15c8a44f6a60c38f4dd1c56c9cc1733e2abd6d49fde22f21d0f4397699d197c5a73455c7816135c02da071f6e98fb1288c2e52add3a5515789cdd30acae9f8952f2b14cba7eaff9ff278e0b22a4bce4b7f7d4a1d65688b145002439fd6526aa83cf4d5329eca06ae7e6e846d8f98e96936040a3ebbc3e2e5cd1809ca00d864f5fef5972fd66d32026654e0072c7516bb161546eed9a28bd9a98e3abe48a397aed1c7a9d141d820cdc76787a32fc37b033878f8dc90b1c0806bda715df54df2e4caad48c4a0d3b708d629694d58e11d5f0f025f77eca8a76f08eda2d57596a0a8ba07bd9aa10c3bd29c7f2103cfc097e86bf4174048197c9f96a13201e171eabd1106d4f0c316e78cd94bf9d6da65a2d0b786b180d80aa5d2825b7c28836c17ff575fca1c0d50d447fc063040e19646253252eef914d725a258e7f010f34d2857e7b7df47e7bdbd947f197cf2e5916bb837f4b224f8ea214ff377d3405da30558f5d409974c65ffcfd30d27c7ba46a9c944a5a3a7316c4b51d6824bdcde265e6b5a3e3e09242f3da54a490fab36844d71e5db8654a628a875d0b8404cd579735075e1e33a2931377ef93ad5ee21e2bf9dbb22ad4f93d7a9f843e30a494f4ee8391193a00f00457451948e3e31acb6875558615cb2450c7f7ee3c7e00e5176c2360241ac7f0a3f79fb0c304cac0e5cd14c7854f0253cd62b86ee3ba2648f0adedfd81394871aac9487073f1b228e4c8a1ab529c8b6a53f181e7f605fb2f9658cb513a59055e7ec5a1ace61d87d0e45d356cddbe85bf780a16d3f390e7317b7aee4a137cda38c91e63931d2b8a7bf0f12b2c0374ac52c45ac0cbffefb1e08aab08080dc431c85bb796e21b8e46f02d1e22f16631e06797c86d0c40d84c199520b51fd996c2509672c78f24879356b8f4eea9aadec12af7687c7721e53da942e197c9cfaa72e3fa6c89beeb16b6a98a3c4f3cec0fe48a2b44688813ddaac408c8bfb9290554b199a852766c8509ae238b81f3e1cd25bd3e32b41699d583f0a10ab864af090331f780fe5d3c4cf0c846732d84b492f85219618238947ee9450a50aa213222632fd5da4f2ed76ded1270b0d1757d0f02539da2d0062799d106f813155c8feee698a5d47ee47e9adb89417c49bb7731c7dfd8e5c630870374d14aeee8d5e8a758a6732523dec613ddd34aea01ad8b97816bd09307dda63d49919aacd23b995270ddc13d28657b9d4d584aa7a6807325c1c262a8efbca9ee167dc19d0398fe07f2b574ec382d7f44d6558e0773da3ec9281fc2e09845fe2586c8294e636a179f4d3cf6c0a06e1ee10396cffe751704e1f9f1860f5bb12c1f1c80e9dfcbac7d7574baea2841a95a80595f2ea56cfa0353887b765eb5caab2a42fc040a3125e7d25f78b1088758a79498fc357819161d144375bc8eedf9e1310a586f7b7a8ba2e8358b75814125e5f3510771043c6c5c171b909a655e8d6f8c02d2010451fabf8e0f06bad2cc18ea0ab49c7f7d689b625b1337609dc2ab628f8ff2f564dc6dc64f227bc76896994541d45a9e5fa67e24eb0b26192b941798fc5cde7128d792d6d4192c2529138bcf68562e6a3c5834c824ccd4df43152e6b76bce3b105f8e0d9887430981445c5da21cefadaf6f9e14773b77acf8bb03bce568641d07c51975718f1f12e3683b57178a187c9446a76dec3f20187c78c905dc0d18e31c80682db46ba45b92cf1773f731f39af0cc131ee5ded1c83472482719699ee7fe3b54690d5a41eee3dddda423e710bf0f2a3ec04a8fd46d12d8fb93de54ddbeddd41e8b080084dd2363dc910a7ea8484bea8569b977250dfee1954f380b769d020cd5571b0c8b548fcebbb02792a265d82f833b7d53b3d496ee965fe7dfb559737d21794758d1ab86efafef85357c66622e990f0cea13bed49913b083e96eebb4880e890880ae0f0585a6b85760ecd8f52ae5491d927a6df052f4b25907f5e317f88d823aecd62a94e2793b9470ffe5ffab17012a1585d265e44ccd94ef309d9b3dce298a01a3aaff36a865fac39c13be219dd3ed884c294360439e2bb1a3c249b8003d95f91c33ea03d082d9b291c25e84879a89d091ceea8e99b5545f0d0d6a2a5cf39e11351f8cb7493c757fc17f5f3bdf40fc8f5770f7683dc0fd8f69a4a646ccb8b41d5e417719b9eaa318c0dda52e456caaa818e4d3df769e83d38d454505b25dc10425c79119763e54cefe60f3d2ad0b8fa2c3f03feb786d555653e209eb8d016075dfc45d0c790fa876a30ddb04dff3be7fb49a99658dc3ff2abb731e0ae9c89264a16cd2e6f772e693607e2e7a4ecffac28a5465ed5b9f788581fc1d15d5dd2a0efe2799b2e0945da3cfedbaa1afb2336e63df07bf99a13394a05633c6887bf352d1fc5bce78a1ebda991598021f1dd93c63366340af372bc7abafa1374f0b147f4b9ebb7b1d39248e984687cc058289624710653cea88eea7eda222ec921f22cdd9131346eb3bd1440cbd7d083fd32f15bd2edb8f742ea4da9cc84479b151cf1ca13ad832bf554a150bfeeb4eb3b8f8d535dbb9411e96f7bbfbdd5d0d5cfad84e04aab4ea526ecf776d7d125824983b92cd5a39da4090a7f3b6fd9c473bbb66d190a7cd1d909c556516620d47abd89035e3f19d589f5864863481e1f98fe7f3425cd7fd76f79842a773065ea474a23fb872a04d6836307e5d30628a04d169db85161a23219e82311aea592ca1505331dde394152f11c87412fc426adc1bf70a0419e9ceb7ae1ed6affa0284ccd694660710a6966e7ffb8a59c64e9ea78b279e874c68bb09f90698179fa1d986816c9e8eed3bf1af2e76411a72b03f144e3f6e5f8ddbf3de787ef8ee8ded4e3aedbc34a7a03ff76014802b01e2a8fa4b31c9d5d2bfbc6483f56ef241ed5beae24d9ed91c45e49b1bd1eb07eed855b6eb8b49b2140920de8ac4f748897e5a62e4a8e6ca6a1dee394da0a7cddd84d7a86e4cc2a970b259128217b60f697215387b87374abd4188100bdd8e2bbe0abda8da0060f5ef765a0a564243702563dab027663a900c2730b774147a6bcfedb90c100135a6657f04b9c4a68afe7dbe2434370f610b9f7555069c8ff3d984fdf445baa2b1c910a240a08f3fba3e181fd84649d0d976be9eb34e5c7aad499223190d6d9469f90773e38d8de1658fead7f4c8ec7686ea28dcb15616a9718c1914bdb6ae64ab7b9cb586edd2438b1a10072c51efc681aed13e949a8c80ab139944c0b4d6b6e10f06a4fb0d7001ff5bc5177aab1a680b06380922fd14bb20359df08e9239ed611e24bb0060b855f579a0355f21bb6e14abf9256e5cc812b39f362ba146f504cbb3a47d3035248972ebda9b01e0e7427bd7679f8ee986b1bb90ac32b68fe9cc5754ebf81abbd06128a337bdf60b5c92f8362aca309c29ed3aff6c03c1e80c213e8994b7db1b09e3e4f1d84dff1130a83cc874c0b8defa544e7db57a5a6b70f275329c4743739738e458f0e70a3cf09233e7ac023f9840e7a340739901d1d631c31cd3969c2a46f4bd55bd9981bd8210d4216ca8c14bc3be5fc3c04d62f89a55520b004300d2f499da8b7673415f060296895e31cbb5fe9ab89e175271086de6d186c8ba0d4b49ab565b0d9cc98d8b6b1ce81fad3a6a8c6c8b582113b6213741069352a1c42cf61b5438d53ec91514a68cf00b5facaf8e2f960feb50747470fbdd7439d5184dd5470ba12d2479db34b2397353e4759049a5b474cd82964c12b1184e96240312def4a3fc7d071c99dc88a57399d094368dbb68177c8d73e297a5450c3f4ba8bb602035c37dc665a691f2eca9a682f028bbb1b0c276b0f56e5df352ad7acdd23bf5b064b8efcab3d6f3a83c337424574f512564a263ad90e43c5188225d070d96db8358c9a44e49283710c1d043034d113fc15f8d4376a692bfb7b739a1706285f24ebddc81e4829908fb61f281564a9c61e7725f886bb9fc02b7cba72c9fd15af4b9d9d0beef99bbd9465c90247c096ac6f7f5e97e27aa3721f564245b023bc84bf2fc763016dca298bd2c2f6f04f7dad568a76d4d93f47879bf2129a5914d7ef31a49a71618a2643bf2aaaeb2ce70a5cd805aa5e6edd8509215c13f174ff1e59248007a8b482db0b41db75157b82218cdfe2a41ec0b9a55863ea7ca2e9a314c8c8235084cdbae2f50ab513e31aea871ce13c06cee1f0d5aaa5ca69126d7b715b22d", &(0x7f0000002080)="7790ddb0d9cab94c08b658ecb14011eaa65a9da24afc282c8fe027b07ac99c6059b8ec773487b3ed8ea336831582c4cc6636564a769a56871e1e57f424b337da4288d73afb7f2bf9594f5cda41cc7256db50f28c7d2efe39c4c9e1d4463f", &(0x7f0000002100)="a7aa8f359e77a96b37124298f94c6abfc06fec9c632f26c0a6505e844cb282ffe52c47f516d1cc1d4eff86aab5bcc3920f77f8eac82c726fd7eb74aff31ee18ef2fb7a1049805a71474b18acb860fa88210f4a0c787269c019b95024db6841b07a63bbaefde0ed51ba7e521da1228e426a64f2bab00af21ce419332137007fb621aefc132eb229da4abf7c23922159c1501f2b2d208a144afc7db8d9b5ed9068fb410ce3cffa759c6801ba66a16b0ef4c3a28ec82860de501a954d8faebe19073f362548be95f9c0c56de318914529d33b5092bc41c7fe964a0457b8d8008b320cc748361f40d97847da09a5e629e7d0b0e6ca8da8faf8cc94450c3ff9bc3d09b1439ac9b1a32391131a0638e9a30fd777e4fb1758fc7fb60113959a619e9ab4e8f880ae6da63274d2e511be118f292891a4e3fe2fb8422fa2414d448737a1452c17735add4a82bc0c38d3e60f7c899a8bf4b346b7751f2ccc3c05f17c76509343fa56a69c9cee732ae0b0460d5a8febe89c5820d359e3281905704e93d1386be402221ee9200ee9f7ba81da8f8493742e9a6e1d3cd44476593ddac6caa93afb258b11d5dcd35984efcafd137f9cdb68b98d56ce23e7496681fa49bbe12db43ba478c0461980190068e89478d09bc9b45cc675cc12ec302a0d51f01921dd21d8038bfce4fb7375a60718171725c71f988db624eec74618918df908a63044a078ae61bf9446f502af2481f74d51e36297a6548d96f1dd3203b9c494d0d549fcc8c4ef1983ca458b22ed8428185f2e04d10a336e1b04f5c551cbc609c4f6ebd2b2ffcc9f62292912918b7d821ab7de12f137b895a158170f4b9ee07f1249560f31441a2952be60e1573e0fd4fe3ee73610033097b9d6c35d94c38964fdf9905975182f916ff2a0763227a0b0260a576448e2ddedeb4a5c90e5d56b6a75f87113856fa9aab89e97458cc271e99227c4325b0b6f9789474593733d40eed97bc04d56cc743c54af103803e5d418ebde6f6f1ea0973371500c9cfe199b0acb785051eb6358daa37f3cc77aea8974833a7a9f71f72eb91c6f0fbd7223c0f2cd05b5301bda9a99f3e83de280924860aa123e39641b3c29e8f524451d447210a50b6aeaa2cecc9d4c2ceb9df7719cdc2615fe1d371957ab5a4ac8dcd626443d0119ea61109952698e5bde6d0c2cd46bf0edddbc8398c959485c22f5a6d798bc7cd6f4e8c434d28146457ba82266a41968b6592e87154031824f3d17e26bd4a9369dd99b1f0984de045f08372f7ad447758c22b8eb19fb2ec12834cf197475e4385dac9c905f5637cb35cd199c1ea85179f1810b9e7923f0622ebec312c8c7636609775776556116342635b9be53ed86fc330bac35f225950fad923852095522acbc16da5421c3b51d915ff693b89a75994f0bc58085d2761677c4b321b8c44f3e2d7476c4fc090495efc893ad3c21d3716ae11ee9a83168bcda32a4647bdc0441d7c67adddcdb8343680e25ae06d8eae141d51f47694399af395c15ab4961b6fe0337d720c2153ba7cec06fe4ee3e5c63c83983eec7bd4131d4746ffb06347b9c348e566ae4585ea03e5fd11a28cee50e5f398c8f19c2687323777e62e6fb74efb1b222f2762ec3fcc8db60046793ed0965a2aaa552789fe3f9255a02f583993d615fd4b8b8b95e58ea3ac65a96f68f9b16709dd448f5f88fe24418b77d9dbb9bd001b350b8a375aec20f1602219cc6a14e40885ba6ed1aecf783ca7c47b8ea7f8d8d80c464849587af23c560f3b97b2d03205fbd320eae00792244cbfe22106e0a6390352a308a15adbd507692a25777035fd0813494924bdb823bd1ed2bfb4f32b737eb5ee58517cd1335893893c7e2b147e41b74104cd34f050c3e4910a3623293c082a043e719ec00d70035bde4f079a2a8ce4f7b31aab68b3293a4e10c6118f9545d8861b1296eb6f5024367de8ddb6ef271a70e4053c5847d158c3873f1794adc5b5bb60e955ec16fefffc3218aedcee93b4922890ec4a4b18649a59406f3c6b344f8bb06fbc2673286d76174861b1de26d821202bb7ae0e19df353726590fe34d2a6ca3b3d0b8b677f5c970571f4fe89c891e925c4ecdaf281d6cbd3647be95f91df84f17af52eb344518e2e77a246799ac09345bdbb7e3c39d6d7f2d9d99fb1bf1369dae3cd93be6374509c01f016010a581a92b8d471cf183df60961ee5bd525e34ac9b98194408fbf74272f5bdeec2a11f3f532aa05663fdf5a3f84f98c9c05de2a2dde334598c5d9bfaaf36df7134654175a5edd9f228fc584fc1265f067a5d8531120724a396eb57853764237e2fd8ef01e8c5b121a70df47a9b653564bcf4d2a51a861ea3283ee761ab5c69892459ef56648f1736cb851b5c225c1c4eeac5084c957ce3488a0c5a5085d3f76b47a0139eddb6f316238ba53fea9147188c7c5e0b3401b4cfa096bd861d29f1c8d4e950f3d5fb48aed4e7ad186b72417f0fff754e5ed9f4cdf5915c3d43806268fb1097e68eb9f4f31a9c8eacb90d777fe32531eeb30f782d9d330657308497774fab40bf9bc28e64a3c0130ec6c03a367b9aecdc955c8ea73f1b4049857a176b67b12fd36c03d4c108747a9f3b4bddca251aea67ba5566f6659f95b8842a5584ace148c2aa700771197e7e92eb556fe2d3e76de2d081b2e15b4311cfb007135719b3a6a9feca3ae1b2799b1c8852d7a2340e21308eb9f919b5303a62a5afd3871c0df9afea1ae6e297c9491d94d48871a3389850e5249c974a17636a63cc86a933e28812f80e300c82d81d107205793d43ddbb2635b916434a6a099e0d91707e32fd6053379c599618741dfcada1d7b77e904a4a49b202479ed129c5b74850d523a218163aa9250d228feaacac8feba6a886d107a2a53d2d6090b3c70e6aebae4814556da6611d81fcc26a3cb04077e491ac4ef4905478f65a7d307a1e06a8c6cf8a3d392b52fba6c4abd886913410007950004782beff0906116762196fa367663e4f464372393a93c31eb3462e256175d38ef70f83bbfdb85e883eb1ecc5709855909970179eb4653ab3a7dea5b475b55e603242180e43dda9bc1e0236319a43434d746b2f105d17aae432b23e79a3e50eb0d7831e64733023c3e8546455bcd6e4be4e4ecf26b58392673480b2c2f106b9239a2a2ca1d6f7da6d44749583990622efa3fbf6eacd513ee494f342f63d6305928ae9563f81c4ffd5c949072b0c116df6bec960f8dddcba2d4c11d3974baa3beead831df1bf098cd0708093eb3346bc15aebea5cb60a905c09e585583682a961f897f5b20be18ba588756a2195ccdf2a014efe8f35dde0785abec5f75b8b644d89c131020e14810d91c07039d0b2111469f0187b219a594be106f90df969ca81d0255bb9fd66daa2a4f37dd95650cb6932ab98de85fbdcb5d4f0eec23311b753225f60ebecddfb5843921f6011c36e531cc4616d916c85848e769d00066a52dab07c9d22575ecad53685d17b316953dd16b579a9f7de1beb6af3dc45729a444d78ec001a081f8a552273ba409ecb4ad631254650e644082f6f5974c47b7a737636e5de510a00d8ba18a34d6ca123b6cb58c95c048d74b1e1d7aadd188de34a9ceebd355f842f540148118988ccb3e224ee6bbc32a7487269d4275f9d13f1101e25b67d4e905cab2a3de2fd8c3b6558af95715c8e1492236a6f6293e5997fd183ce9d6f220922f07dd4ce44d34a95ade5b0345482d437132bd759bf2aa45920228f9343ea512aa596bcc8b4b3f17aae205c373634d8ca8d7d6da9fbfb237115bbb338f228442dcee357b55b7a2e2cb58be5d88f1b58369a83c157d32068a7c472cb48b452fef282fba62471d476694f473ee7a030cb948fb50a996827928fa2424d0ef038847dc79fd689c0344ef7f34ee57965ec615bcbc5d30dcf019bf3b14efa53a62a8ec1dfca0f93bd8e68afaf4bbde8d6e42285ae1be63b8be7aaf10fc44389afa3388fb1f0671def39e5fc2e2e81dbb0a0b7bd56c84a543db99838451bc79036d9a125ef46b01e80982d751f0a5de4252a23a44bf479711260636cbf805d2ad554ab649080ff00d543a6af5e3c6f64adfd00d4c5c43ef207b98ded5498bee2136f736c041a33e198725e101a7b0d79f0f9f5e287ae7c4120ea359bdca6b751e94216646f15f3d8ca90c8039b170ab1c7280525a629a21dadb606937a3e4d17da9d2fd9442c433291a4d27abb2d63e4c4d5ec583e64019f326a3d40eb1f6c9aa09e97a53634a98773be785ef8d4ede6ec763361339b90c54bf345064a16ad466552c95cb40e57f36de0c50946ce135cc0379613466e40ad93c4f9bb8a5fc75a0a2e43ec5be5a1b7b7bc50fece2579bc33a782537b1ce4436361d3294aa71b81f5b8c04213793c0494db85e30f76410de11d1daa545ea025e2fb13a1ec56f03c35302afc5f6498c6ddb3841a371749ba2f62c95d46672adc186327f14c4dfaa4c4312d54d60ed6c87ad36c6f1242037a14bbb8e5d6d942927eab646f2e3f328bc88156a00cc49179ce5c508d4a711714e0fed539cfdf7786be6310998669b579d3d04af6a27af7e6f1f74cb4782a72a19aafd443041c86025c35fdf29c4ac1a7ce150091eefa2cb65324e5eb614756a3ce79682423a4dea58396308e19ac0ce00e31a302448a50eb407a20fa9130ee3c61bd8964e076652b13d687897c1216c8aebf2a190eed93b181092e4803c946688bd6c2d3a2657e09df494bf3401c336af5b82549f352a6a477b259c6773021816e57138b07e6860b0630cf36320acae8376fdefd7464f25db34babc2ecaa3ec62158b5d818459f23ae88a593de7ba1f95e67f27b4dad851915fe5f5620cd28aa457cee831c20621382130cb18bd9d33a54b6e1a72c86f8c22bac21837a8c2457b5ec26a1948535a4d932c80f0da89ced698c6366bacee04dca65136ed5f6ce6277d4a510bae16dfe9f7ee4a04d360d86100e1cd95d38fe1f75bb45186daac4b1a0c4f887406a3c4ca088bfc192199940e5e4ddd839167ca8354b9acba5235dd4081456492be6a8fda2470d9a39de48c9da9097ce9024a8f6cfe55043b6e0f6db9d9a17687d108dc51cbe4a19686f63e706227cf9084cecf1c858a744c82d0320e0281958e58318f198bdb8a3dd257687d438b4c89a5edaf4ebcb3a160446668a20ce83256bb5118521ad063521b40549f5644410beb9fc56dfff8673b85838d5a1e0bb6d9731f1e97be928a9fd3b4f1e6205be02fc5824f7ef07f61b28cde7b55771603606ccacdabe3e4d0ed96ac95987dfe885052c4c13575d4cff275762cb4f33e9a9cee4abf9b0f15660bbcf9b9294a4287b1e90aae7d20ceef6e350b12142c8f4f2b2a0ca7ccbd92a7458a0358c33f764044cd2e30ba9f0160933aa2e7a3fba1eacb8b19d3a0c46e420355a9d31a4530af9c423cd99f5eefb86c5ac80e278afd39beb1627042ccdd8ed8e7887c5f09e2c0563a9c6e0e902aaac61bf1332616f469f9de6f17088f8e6c1f0d40e1151832b5de3366f586cb8b749d4cb61d7455d9c943e008aedca7355b7281b0e144a4ae79113fe67928f50f509fe681c9020b838e7753cc3dba02af2c690ecc22d8dc62aafc03dd5689bd4b0a0d91fbdbe757691c5e983632b28be3e2825f2b61f25366ed59af82a60266a0139b81831eab13db801caa550fa9bfcf02b7bc951c03341ae375753fec1f81048772ee47ae00f8328449b80a42cfadebd7ad0b78a05d724702079aa62f629ec5da5007cf7ea785999f98a8176bc3d710024b1", &(0x7f0000003100)="06a220d87b98fe67a01fb4ba1603bd14054963c5da31216c17d98f48bcd23290f0958831d4e9369cbf71e54697522a288ae8266d6fa0f66769a9c43cc5fa00f8173f477fb51a8f27bb22c38be44da91726a8cd57448b34119f7a53f1281c953b67dc2c2db9e6f75ad31bb70c971ff7acaf61b364a2a0c48351da695d79624f23b39db14034622e8c34486ebaf4940ca256a61e0f32d82f"], 0x4})

15:52:02 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x8933, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:02 executing program 5:
perf_event_open(&(0x7f0000000100)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x24000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
r5 = dup(r1)
ioctl$DRM_IOCTL_GET_MAP(r5, 0xc0286404, &(0x7f0000000040)={&(0x7f0000ffe000/0x1000)=nil, 0x102000000000, 0x3, 0x86, &(0x7f0000ffb000/0x3000)=nil, 0x1})
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$SIOCX25GCAUSEDIAG(0xffffffffffffffff, 0x89e6, &(0x7f0000000180)={0x32})
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:04 executing program 1:
syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882)
readv(0xffffffffffffffff, 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, 0x0, 0x0)

15:52:04 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xffffff7f}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:04 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000018c0)={0x4})
syz_emit_ethernet(0x26, &(0x7f0000000000)=ANY=[@ANYRESHEX], 0x0)

15:52:04 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x400454ca, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:04 executing program 3:
mlock2(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0)

15:52:04 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x410000, 0x0)
ioctl$DRM_IOCTL_MODE_RMFB(r1, 0xc00464af, &(0x7f0000000180)=0x3ff)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f00f87089db0005000004", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r3, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x41000}, 0xc, &(0x7f0000000300)={&(0x7f00000004c0)={0x168, 0x0, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x168}}, 0x4)

15:52:04 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x400454de, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1916.984897][T22888] vcan0: tx drop: invalid da for name 0x00000000ffffff7f
15:52:04 executing program 3:
syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x2, &(0x7f00000001c0)=[{&(0x7f0000000180)="cefaad1b4b02000040dc", 0xa}, {0x0, 0x0, 0x3ff}], 0x0, 0x0)

15:52:04 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xfffffffd}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:04 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x40049409, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:04 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000040)={0x33, @dev={0xac, 0x14, 0x14, 0x39}, 0x4e20, 0x1, 'ovf\x00', 0xe, 0x3eac37a4, 0x32}, 0x2c)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x71b7486159eec7a1}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x18, 0x1410, 0x20, 0x70bd2c, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x40090}, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:04 executing program 2:
ioctl$SNDRV_PCM_IOCTL_RESUME(0xffffffffffffffff, 0x4147, 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={r3}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000040)={r3, 0xfffffffe}, &(0x7f0000000080)=0x8)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000001c0)={r3, @in={{0x2, 0x4e20, @broadcast}}}, 0x84)
r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r5, 0x40046f41, 0x76006e)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f00000018c0)={0x4, <r6=>r5})
r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x6c02, 0x0)
ioctl$ASHMEM_GET_SIZE(r7, 0x40186f40, 0x76006e)
ioctl$HIDIOCGNAME(r7, 0x80404806, &(0x7f00000000c0))
dup2(r0, r6)
recvfrom$phonet(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x20, &(0x7f0000000180)={0x23, 0x86, 0x7f, 0x2}, 0x10)
syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYRESOCT], 0x0)
socket$bt_rfcomm(0x1f, 0x1, 0x3)
write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x1b, 0x1}, 0x7)

[ 1917.266614][T22907] vcan0: tx drop: invalid da for name 0x00000000fffffffd
15:52:05 executing program 1:
r0 = socket$inet(0x2, 0x2, 0x2200000088)
sendto$inet(r0, 0x0, 0x0, 0x4008800, &(0x7f0000000200)={0x2, 0x4e20}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

15:52:05 executing program 3:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, 0x0, &(0x7f000095dffc))
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000100)='cpu&3\n\n\n\n\x00\x00\xc8 \xf4\xb3\xca\f\x1ff\xf0\xed\xe2\xdaX\x96\xe8\xd2\x9ba\xdd\xba\x93\xf3\xa2\x97e\xd7\xa37\xc0\xae$\xef\x1f\x1feq*\xeb\x00\xffx\x7fV-S\xeb\x9c\xf5\xe5!d\x99]\x17~\x9e\\\xac\x1f\x93\x00\x02\x00\x80T\"\x00\x80\xff\xff\x03\x00\x00\x00\x00\x00')
perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
set_mempolicy(0x1, &(0x7f0000000040)=0x800000000000000, 0x2)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x80, @remote}, {0x2, 0x0, @loopback}, {0x2, 0x0, @private=0xa010103}, 0x9c96a42f48eba4af, 0x0, 0x0, 0x0, 0x1, 0x0, 0x80000000})
socket$inet(0x2, 0x2, 0x0)

15:52:05 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x1b9bfc69acc}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:05 executing program 2:
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4, <r3=>0xffffffffffffffff})
dup2(r0, r3)
r4 = dup2(0xffffffffffffffff, r0)
timerfd_gettime(r4, &(0x7f0000000000))

15:52:05 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x40081271, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:05 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x83, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x2000000000000}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x4, 0x80000000, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = memfd_create(&(0x7f0000000900)='#\'%nodev\x00\x7f\xe5\xd0ql\x86\xcd\xe6\x14\x93\xb0\x7f_,y<', 0x0)
write(r1, &(0x7f0000002000)='/', 0x1)
sendfile(r1, r1, &(0x7f00000001c0), 0xfec)
perf_event_open(&(0x7f000001d000)={0x4, 0x70, 0x0, 0x0, 0x54, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r1, 0x0)
r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000018c0)={0x4})
dup2(0xffffffffffffffff, r2)
mount$fuseblk(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x2000000, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x4000, 0x800, &(0x7f0000003000/0x4000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1917.828334][T22937] vcan0: tx drop: invalid da for name 0x000001b9bfc69acc
15:52:05 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x40186366, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:05 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x40030000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:05 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x1e, 0x4, 0x0)
r1 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f00000002c0)=@req={0x3fc, 0x0, 0x2, 0x7}, 0x10)
sendmmsg(r1, &(0x7f0000000a40), 0x8000000000000b0, 0x101d0)
r2 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f00000002c0)=@req={0x3fc}, 0x10)
sendmmsg(r2, &(0x7f0000000a40), 0x8000000000000b0, 0x0)
sendmmsg(r0, &(0x7f0000000a40), 0x8000000000000b0, 0x0)

15:52:05 executing program 2:
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x400002, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$FITHAW(r3, 0xc0045878)
r4 = socket$inet(0x2, 0x80001, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r5=>0x0}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={<r6=>r5}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000040)={r5, 0xfffffffe}, &(0x7f0000000080)=0x8)
ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000100)={0x6, @pix_mp={0x3, 0x7a0, 0x32314d48, 0x2, 0x5, [{0x289, 0x10000}, {0x0, 0x37d8}, {0x2, 0x10000}, {0xf95, 0x2bed}, {0xefc9b1bf, 0x7}, {0x8001, 0x3}, {0xfffffffd, 0x1}, {0x6d, 0x3}], 0xff, 0x40, 0x8, 0x1}})
setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000005c0)={r6, 0x1ff, 0x10, 0x7, 0x4000000, 0xfffffe00}, 0x14)
syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "03000000"}}}}, 0x0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00')
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000580)="8a5bd44bf6ca9efa1083cd42ab27c82c", 0x10)
sendmsg$TIPC_NL_BEARER_SET(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000940)={0x18, r8, 0x7, 0x0, 0x0, {0xb}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}}, 0x0)
sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000500)={&(0x7f0000000340)={0x188, r8, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_NET={0x58, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffa}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x10001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7ff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4bce}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffff0000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xafe}]}, @TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffb}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NET={0x60, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x81}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x96}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffff9bb}]}]}, 0x188}, 0x1, 0x0, 0x0, 0x8000}, 0x40)
sendmsg$RDMA_NLDEV_CMD_RES_GET(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x1409, 0xc, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4004000}, 0x0)

[ 1918.062827][T22959] vcan0: tx drop: invalid da for name 0x0040030000000000
15:52:05 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4020940d, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:05 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xee000000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1918.295940][T22977] vcan0: tx drop: invalid da for name 0x00ee000000000000
15:52:06 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x1e, 0x4, 0x0)
r1 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f00000002c0)=@req={0x3fc, 0x0, 0x2, 0x7}, 0x10)
sendmmsg(r1, &(0x7f0000000a40), 0x8000000000000b0, 0x101d0)
r2 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f00000002c0)=@req={0x3fc}, 0x10)
sendmmsg(r2, &(0x7f0000000a40), 0x8000000000000b0, 0x0)
sendmmsg(r0, &(0x7f0000000a40), 0x8000000000000b0, 0x0)

15:52:06 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x1e, 0x4, 0x0)
r1 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f00000002c0)=@req={0x3fc, 0x0, 0x2, 0x7}, 0x10)
sendmmsg(r1, &(0x7f0000000a40), 0x8000000000000b0, 0x101d0)
r2 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f00000002c0)=@req={0x3fc}, 0x10)
sendmmsg(r2, &(0x7f0000000a40), 0x8000000000000b0, 0x0)
sendmmsg(r0, &(0x7f0000000a40), 0x8000000000000b0, 0x0)

15:52:06 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x100000000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:06 executing program 2:
syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaa8814d91cc8960542d0aab7c7aaaaaa0180000000000001ff00"/50], 0x0)
r0 = socket$inet(0x2, 0x1, 0x0)
getsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000), &(0x7f0000000080)=0xe)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', <r1=>0x0})
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'ip_vti0\x00', r1, 0x20, 0x7800, 0x5, 0xfffffffd, {{0xa, 0x4, 0x1, 0x36, 0x28, 0x68, 0x0, 0x7, 0x2f, 0x0, @multicast2, @remote, {[@timestamp_prespec={0x44, 0x14, 0x40, 0x3, 0x9, [{@broadcast, 0x4}, {@multicast2, 0x8}]}]}}}}})

15:52:06 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x80044dfd, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:06 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x846, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x0, 0x0, 0x0, 0x0, 0x100000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r1 = gettid()
tkill(r1, 0x1004000000016)
sched_getparam(r1, &(0x7f0000000180))
socket$kcm(0x29, 0x0, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4})
ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f00000003c0)={0x2, 0x0, @pic={0x1, 0xac, 0x57, 0x2, 0x7f, 0x20, 0x9, 0x1, 0xfb, 0x1, 0x2, 0x3, 0x2, 0x9, 0x1}})

[ 1919.706151][T23003] vcan0: tx drop: invalid da for name 0x0100000000000000
15:52:07 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x200000000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:07 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x80086301, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:07 executing program 3:
r0 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
listen(r0, 0x83)
r3 = accept4(r0, 0x0, 0x0, 0x0)
getsockopt$inet_buf(r3, 0x84, 0x9, &(0x7f0000dcffe8)=""/11, &(0x7f0000000080)=0x9b)

15:52:07 executing program 2:
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000100)='cpu&3\n\n\n\n\x00\x00\xc8 \xf4\xb3\xca\f\x1ff\xf0\xed\xe2\xdaX\x96\xe8\xd2\x9ba\xdd\xba\x93\xf3\xa2\x97e\xd7\xa37\xc0\xae$\xef\x1f\x1feq*\xeb\x00\xffx\x7fV-S\xeb\x9c\xf5\xe5!d\x99]\x17~\x9e\\\xac\x1f\x93\x00\x02\x00\x80T\"\x00\x80\xff\xff\x03\x00\x00\x00\x00\x00')
perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x800, 0x2, 0x0, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x5)
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000200)={'syz'}, &(0x7f00000000c0), 0x244, 0xfffffffffffffffd)
r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000140)=@secondary='builtin_and_secondary_trusted\x00')
add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, r0)
bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001180)={0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000021c0)=""/4096}, 0x18)

15:52:07 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0xc0045878, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1919.940408][T23018] vcan0: tx drop: invalid da for name 0x0200000000000000
15:52:07 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x800000000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1920.161022][T23033] vcan0: tx drop: invalid da for name 0x0800000000000000
15:52:07 executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001})
r1 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @loopback}})
write$tun(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000000000000000060a5c2680f983a00fe80000000000000fc000000000000bbff020000000000000000000000000001"], 0xfca)

15:52:07 executing program 3:
r0 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
listen(r0, 0x83)
r3 = accept4(r0, 0x0, 0x0, 0x0)
getsockopt$inet_buf(r3, 0x84, 0x9, &(0x7f0000dcffe8)=""/11, &(0x7f0000000080)=0x9b)

15:52:07 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0xc0045878, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:07 executing program 2:
r0 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
listen(r0, 0x83)
r3 = accept4(r0, 0x0, 0x0, 0x0)
getsockopt$inet_buf(r3, 0x84, 0x9, &(0x7f0000dcffe8)=""/11, &(0x7f0000000080)=0x9b)

15:52:07 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x1100000000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1920.629433][T23048] vcan0: tx drop: invalid da for name 0x1100000000000000
15:52:10 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r2, 0x40186f40, 0x76006e)
ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000300)={&(0x7f0000ffd000/0x1000)=nil, 0x1000})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1a, 0x4d00c39c2c2abe3, &(0x7f0000000040)=ANY=[@ANYRES16, @ANYRES16=0x0], 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, [], 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ubi_ctrl\x00', 0x200, 0x0)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/217, 0xd9}], 0x1, 0x3)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:10 executing program 2:
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240)='/dev/nullb0\x00', 0x4000000004002, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0)
move_pages(0x0, 0x2c9, &(0x7f0000000000), &(0x7f000026bfec), &(0x7f0000002000), 0x0)

15:52:10 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0xc0189436, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:10 executing program 3:
syz_emit_ethernet(0x36, &(0x7f0000000040)={@broadcast, @random="e0d35b1004bb", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @timestamp_reply}}}}, 0x0)

15:52:10 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x3f00000000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:10 executing program 1:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000000202e6"], 0x18}}, 0x0)
recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/95, 0x5f}], 0x1}}], 0x1, 0x0, 0x0)
sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)}, 0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'\x00', 0x23})
socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00')

15:52:10 executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000180)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [0x0, 0x3f000000]}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}, 0x1, 0xfffff000}, 0x0)

[ 1922.778360][T23069] vcan0: tx drop: invalid da for name 0x3f00000000000000
15:52:10 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xcc9ac6bfb9010000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:10 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0xc020660b, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:10 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1922.959141][T23078] vcan0: tx drop: invalid da for name 0xcc9ac6bfb9010000
[ 1922.989700][T23079] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 1923.026677][T23075] ubi0: attaching mtd0
15:52:10 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xfdffffff00000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:10 executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r1)
r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
dup(r3)
setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f0000000040)={{0x6c, @broadcast, 0x4e23, 0x2, 'nq\x00', 0x10, 0x8, 0x66}, {@multicast2, 0x4e24, 0x10000, 0x7ff, 0x0, 0x4}}, 0x44)
ioctl$KVM_ASSIGN_SET_INTX_MASK(0xffffffffffffffff, 0x4040aea4, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x60}}, 0x0)
r4 = socket(0x1000000010, 0x80002, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@ipv4_newroute={0x40, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_ENCAP={0x1c, 0x16, 0x0, 0x1, @nested={0x18, 0x4, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@remote}]}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x4}]}, 0x40}}, 0x0)
sendmmsg$alg(r4, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1923.074199][T23087] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1923.098411][T23075] ubi0: scanning is finished
[ 1923.253469][T23095] IPVS: set_ctl: invalid protocol: 108 255.255.255.255:20003
[ 1923.277662][T23096] vcan0: tx drop: invalid da for name 0xfdffffff00000000
[ 1923.301941][T23090] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1923.333243][T23095] netlink: 'syz-executor.3': attribute type 4 has an invalid length.
[ 1923.341842][T23075] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1923.349387][T23075] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1923.384851][T23075] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1923.419705][T23075] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1923.437622][T23075] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1923.454995][T23075] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1923.478973][T23075] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
[ 1923.537067][T23075] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1923.570895][T23102] ubi0: background thread "ubi_bgt0d" started, PID 23102
15:52:11 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0xc0684608, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:11 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xffef000000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1923.641030][T23095] IPVS: set_ctl: invalid protocol: 108 255.255.255.255:20003
15:52:11 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:11 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x80800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180), 0x4}, 0x8100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x2d975d98, 0x1, {0x0, 0xffffffff}, 0x6, 0xff})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4})
dup3(r1, r3, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
ioctl$ASHMEM_GET_SIZE(0xffffffffffffffff, 0x40186f40, 0x76006e)
setsockopt$inet6_dccp_buf(0xffffffffffffffff, 0x21, 0xf, &(0x7f00000003c0)="0284a698da88bdd53a0a76dd5316489623a5017556377550e20874c96a1609f1f0a9c295d33befda118d9cc416c7c9a3db219454c2d25c8a06921a807f4e528c19b7f6a76b6fbceda5a66ccde128eaceef760671e111bd7d60c579972f83795ffacd3237ad523fbefdc7f3425f667907df54c63b28da82fd738a488f8758eb4d8131cab214a1f6022870fe5a25d7d7dd2698aa2e8feb31dfc78c8fc1ae40b8d4c0f748ba1b7f6c9140a026afbe8ea5461f33a8960460f8d3ab51d76ab527a200aa72c0d9ec0f9ad3e7340939d485c86537d81a0f827aa472c9edf625df1a7bf74b77ba7ca68bc546167fd39ca4ed9926f2d26c7d0174119317feaa9345be74a3b1dc61bc5abde87edb6567d8410e03371991925f7214ace58acb00e81c403a097fadf7cc99132c679502be93bf34940aa3eadbe8dd92f3dd7ad247ebba2025f144492117a654c5f397ac482cd53cf7ae5b734af45bd86892750db0c5c65f8f99dc4fc0e96ecf890f103b94714f73150201fcabfd8aecab59dfc1c65d03debd2cf4bc36b99f8c380cdd34503a71c83343498f7f858e3b6f645d8c2805e11d3b82526eada873c6750c0c71a63fe1660c8581e0455490ec9f6c8ff341b05c86ae31373b4230c23292df86a4559a81abae8a3cd8e3edfdad56f63f8bde770ed4dfae3a1eaa15b693b415fc61ae5be29dc53f958800e82c031e2481fb7367ba7fc684342dc788ceff2698f7c2545e31a28f5680ea089121376c7f1c3ab70227fc819b51e48e6d71a8c22b5a1228cefd78d371fbb2f935c621b1e1f234b12dc0c0b3c706f6182772c9efdb11b1c69ebb87bb3971f42b9fc29f8354096da1eaa991f8f933010c247c19aea39decea04db0ef5b23fddc41720e41f6c178405fe87596505acc4927f3979c6bde77b85dd25cd81994e8910f88bfc163f9ff8b5cf89c3544cfb4036eaf44b28150ac95a092dcbeb2bf858e08eba3143d6d18508d6c25ac60652b418f3a6d0aa9d338236a116d58e8d85fd766b0a4430056acf34ddf36cf930bb068af88ef3af7f673ee5034ee5b20647e44d3900e8727ca18c235c9b9b718637de431c6798945ec4a7ab31f660c5e5b8ddc4cbe8c6d3d1eace2d0986d4a33ac940c3f4a0bb0b53b326738c87f062b9736cf411e8161b8c18513807e8786f1fe8b52fa0c08c67c761c5d1551b59e7a59972741a9b835c07dabb440c5d2f2b6d16d2b1865daa1d5eba7045e2f9adc9128ac5607f3929fe386e9ed407451618746037aa5e2a4d4bb46ed517c4321c6308f088ad6f112c57418f2e6740fd4abec6e26fa1b64c51f0aeebe7258a0b8071afc0453492c25ddd9e22ba8f2069bd64c77bb9424f5d4440531165f65849d85dc703feb2a2df52298a5efae03a7fd401824abbb716f743510d3aba0aa5a527b043c03a8c1933fe580c0b8f44c6218a680475f48dc0ff76f47fed48cb04c2a720f3677d32d30807042452065708b8a592fc20fb0d86fd7ba65a764069aeb4355edf12ac2ec1a2f6b24ade919d8260679f9cd81d82aba49c2b18eec6ac1ba4adb805a8e89e5ba4dfb0e8c3d42d8bd4e1de1bd261fb4219c21c54c92e1976aeec86ab571e64d2bec92a3a9871736cdf7a481bf61933d228fc54594b966cd18019871327596c707fdc2e3de91f03d885e5e46aff08af1f39010768f255cd22c8b98330ba0e0f6356d0a5f91b8cd2ce1c047aa4b0cd6ab0ac71007a8a0dbf6a2e5e6fa4a53fd163337db058d817647eb1aedd098c957deb1ca60f1106e4d70507016d4f0c5ab442130e82f106ef8a9368f974ac83f72480645c1362d6659971910db6605d558348f1434cc504f61e8e5f88ae73a87f70d9a3b3a538a789a76ede463318fa976618ca2d811029aa1d5d1bae6519e69ca4bcb451751989c495ec67136de681255783941718cda4112247b71633efe3eb0406f4393d75906f0623ec9ac697f9972ce409ed940722f737a04a52264fec1b13048ec91cdd600cfdfb5c4134bc87eb2a1be843896cab849d554aef386fc956fa2cfce7a48f03ba751e316c8b7edd73224ba39508e12337622a52f32699036c946c0e742f606a606fcb7be516056a114ca3daabaa6e195f15048147d3cfdb4f9efcb07f321f2defdb969a15b6cd9139058f1873e79e3f6e25d54fc6c750bfad11019403bc6dd92b7a9614daa934f1b78ae7dd42fa351d6586022ff6d5311aa0a4e18c32975d2bfb4e6766bc50b2715a22502bcc3d033287c32743e0c97dd4b1ae5d5b1c3bbbcb334fc284cbf1255472b6d8ba0c5e81a9cd8bb777cf17e3da0ee557f9889606157016e5efd7099a6d16be0c0df95d907be778bec87e96e792071d2a60b0470a478ca5ecd5a83139fb1adcb5fb4114fb6ffe8f5e62fbde0cda0a97cfb7145c7732589f420303f5e05767b19e0badcf676430464aff0f885edfd9b63c0dc0e9d2103dad1017d89f7db8673e533638aec8d1ddcd4e45c4000d1e9de3759f2e04f5058531951d085bfb2947bf1dd8dfbd1b3f31c8617c7e80b6d641593e911fdbdaf40c91ed8ed3f6825ecf1167d13afdd8faabfa969a8f7f5a025b683659debd8543dcd0b4619f9a7a71eb03d75e3d8a6f748f7a001644c6dd48ef463ff73bdd44e80a8dca28b030d5d788f4c26cdd0d42ab55c7b8bcf877741d78f21a34ce6f35e7423f1dc42d3075385d57d79b454e9bfc33ff766e9e4ab21addf061bfb231051922565605fc96907ff81fe758e1c071b464e9c19b3ac217d6a0d79107715a9ec005eaf671d0e25f31318d2be7d0e1018855a0565937f3d9cb5c6ea6d749225fd76a5332e4c6a681f50bbdc029a1c70cca48ddf8633e288b99cb6bcd1c52160fd5cfd82a8f798088f949b9cbb8289bb079a3db7b85557724512373bc047c6ec0d6b44ff9cd08fd5d2af98cfcd49a01ff115637e3e1b46cf9eef33b1fdb019a67396976767bb194e96b4eff42e1034cd6e458e052fc356e75c90fe7b357915cb75f50261416cc1258174d7f5eb2dfd91db20ddfdd90ef01ef83e88a88c6294be66e25ecdc92662d692ca760d05c2f048c9b6d456e139a5f4a15dc3ee40932a379964b9b6533bf50bc0c3d2e1b2efdb6648ddc499936ce796a412d567a04949d8ca504276e8d8c60168a8c79929e66f2046c4bbc62c689b3bc6e178987b37dd7f7719f3b8f2e63d160ef8a687b9f35d99d4750281cb07bae388912351d7071ac0f987035b2a1947724a57581660e304e850d642e3a266e865b93901871e0159fce0819e6de7e7a36cf8c03c27f69d4e4d3f01cff4f095667dc36e1359abdbe6c123cbf674ebc803225602d4672588ac96c4506b8bc3a7cbeb3874ec49e71e6f8525b15edfe5a573098bd892dc09214ad9be827b1a2939683e89a708c107e8eb9ce2a43fa6db087715fbe94505cc2c301469268bc866b11c02fc595ddb9ae19b447696c22a70dae14d13618b49d2193a21808114cb1a9f99c98ac527c25570c429e6e1aa7724966a451f336f0c25811d648e26cbce46604017e8f7ca7ad600d9cda47ab688190f7ffec19c5ef24cc0219d32b7015aa2e7915ec3edfec282ed03bf3c09da62d18470c2d31a8fa8dff31e260738131d0ed64ac4dc57c0789d769ce0e8af85a9f0b08cdb78c20bbff41c2162823a8703f157153012bfaa999c98c34bc3d444ee416afd85ce7f4a15f3b84ca375a1ab8ca8ce40bcbf1ccfa62c56e999e3b1d314836bb05b7fc411a7cc70c9772f537917353d27c82bc3046323c01d5835038217fab91f4ade2266d60aa7f8dcb256127db221d816052fab42c5d5c2b3aaf09df3737fffb2b7ec4d8bfbdfbef99a04abe1edc7c24dee11dcc0c2e7e4b02682f26627ebc52b3e62bb12f05312af5ab4df838614a5627397dbeb6eba3f8446ece494e4a946e2e25f04d03dd649a37478c1a7c1cef4214c858a9f8576f7bb01fc7d648697e3622296cfb1a26e534c8cf0a36ddfc92b24e5b8823ff219cbd88649befbe5d4e7a36da3e0ea5f0ca6d3a59475a2129bfc43bcf16a86f7d18ba87c75f389ea2e7d2428c947648cfa22a7b0c6661ff5fc4e8616f1d1211d0e79363a78fcc595f0408b1417232089313f3a702695857b6bc16984715b2fb9267da9f8cdb1510ed8aa108857eb0b00621d4c69f50882ad5126d2b8e17c12a1e1792ca8a8db0e45b5443e18d986c0cb626c8704168c519b4f6b2837a42634aa6b54d4baf8d4818750d15e1680ede5f20dc1a342a1ad1baf901a4ec24723b2fbebeff5438a5bba9bfd3aa15bc8ad9817aede98bad2a55b4600ac434c303aafc1d91ac03a36933282b30c1782d7df5cb8cf98784c16b7880420617e275a69253276983a3e3777c8043a0e3a5844b4a7b11f8e59ff5217f56c35ecc0ab381ec6fb28ca4b4e6c2c9ea1829abde00be3a747196ece5f8dd096618b7d3102278bda5190a96eb19b3947a476bf11a096aab1142b34807e4d860babe0b52ce2e48fc0a7261227e9f5d0964608374a3b90315f4bda88ffe48fc1a2b82408bcd032f17793c3bdd120aee349edaad6f54202f76fcafe94eece442573dc8672034ad87fa317a50c5048e72b0fcd5b9aeafc495bf2a563d28438340019cebf18fd112ae411a60f65f6b6d4b997d4beeaf861392d2e5af4b8925b56081ddc74033fc1071b637dea52799948c628db45b3643f99cc267f70d2b4c4d618810a54f0fa296fa892449d8fcf0b3e7cef73c94bafd0d26d59784515e2ff0dbafdecb9ac81d234301361f093c546e3e70c9eb328df1fa0185c9d44dc3ec41013ee5da5a3d7437aab791e4ed460cacce2573e54edafd7c1e92e48a4ed265f55090900cf9ba4ca22d69ccad003bada3d496bd0839422c0c3dedecd5df9c7cc6fa7e332325be43b96173920c772f575e819bbd12548318627a78e71c67b7e9786ced9462c20fdf72324147e4424cf57cb19cb741d11861a7e0908e456ef7c76ee7ca66b9ec51f6c47690519231ddb51e9851ee268dfa154fc25e483b35bcffbbf5766f8fb8193e9ed4bcf1fd411614b26544dd320a22c1957d7d6c5da71668025aa6178367deb0855de6691d4559dada967afd1dbb3177b17459aa00630c260a85a1c8f8e181de6f4855945684a596d4ac856fb276af85a7fcc47b230995ea7ec3f3d0d3af6651f5a4fda25b81506756752a69169bd36bf12d75438b6c710778254e6779fc304fa40f71ba4d0ef1b6dd72d1d331ef9f3e98eca97ac593a030ce222b5a1cd543f6adf8aca0787a94833e8fe4975cce04bf02f4d6e429f95d283467e8b375e664a6901f2092f1b252d09c0ce6340054dd19491d4384fb2d4a31cedc6b5bc3939f47aaa3eb02ef67ed9725774b2aea2d900af9d96a4dfa213026b139c3d32fb25afe45673c9b831947c7edf093501cff0d3a6d15d16bda4b2efa570aa20d44523ed04890aff8bd23aca5dbb2567bd03116a34545883da64588dc1bdb3266efad8c4426f28fb9a060cf7972a402ecb7a8689570422e05dfe0a95bf6568a4cb0e672bff65d34a3214aa32976e150a72c09f260edb80bf4b086cd9ec9de85d0b9253e69657b51be1b875d24ef471c8afc33fa3e757aa7f50cab3de2928c519d6dfa0dc2819a23c88402e70e6f3fec168ca9c63ef732c281ed3c66d6857c74bff29a423b69b985bad1700509f75adace014fe4e1c52303abe0c41848212d9df32ebaa17f46b3eaf18536dbed056599749405c0ac849790c1e28ce3b391a3ab6e50a971496b6c6c77c42a798ea84df6d627b3cabd79be4f58023a03c033da84f6132cde7f", 0x1000)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000040))
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:11 executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r1)
r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
dup(r3)
setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f0000000040)={{0x6c, @broadcast, 0x4e23, 0x2, 'nq\x00', 0x10, 0x8, 0x66}, {@multicast2, 0x4e24, 0x10000, 0x7ff, 0x0, 0x4}}, 0x44)
ioctl$KVM_ASSIGN_SET_INTX_MASK(0xffffffffffffffff, 0x4040aea4, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x60}}, 0x0)
r4 = socket(0x1000000010, 0x80002, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@ipv4_newroute={0x40, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_ENCAP={0x1c, 0x16, 0x0, 0x1, @nested={0x18, 0x4, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@remote}]}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x4}]}, 0x40}}, 0x0)
sendmmsg$alg(r4, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1923.768754][T23114] vcan0: tx drop: invalid da for name 0xffef000000000000
[ 1923.777463][T23115] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1923.824401][T23117] ubi0: detaching mtd0
[ 1923.857647][T23117] ubi0: mtd0 is detached
[ 1923.879411][T23126] IPVS: set_ctl: invalid protocol: 108 255.255.255.255:20003
[ 1923.919776][T23126] netlink: 'syz-executor.3': attribute type 4 has an invalid length.
15:52:11 executing program 1:
r0 = socket$inet6_sctp(0xa, 0x0, 0x84)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, 0x0, &(0x7f000095dffc))
perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x80, @remote}, {0x2, 0x0, @loopback}, {0x2, 0x0, @private=0xa010103}, 0x9c96a42f48eba4af, 0x0, 0x0, 0x0, 0x1, 0x0, 0x80000000})
bind(0xffffffffffffffff, &(0x7f0000000380)=@ax25={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null, @bcast, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}, 0x80)

15:52:11 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:11 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xffff030000000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:11 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:11 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x141301, 0x0)
ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r1, 0xc080661a, &(0x7f0000000180)={{0x1, 0x0, @identifier="bdd42128390a61a83443dba38bea9df0"}})

15:52:11 executing program 3:
r0 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r0, 0x0, 0x0)
getsockname$packet(0xffffffffffffffff, 0x0, 0x0)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x2})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000180)="1800000033000908d22780258c6394fb0124fc0e10000b50", 0x18}], 0x1}, 0x0)

15:52:12 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xffffff7f00000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:12 executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid\x00', 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b00000073797a3119000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100738d7a310000000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a310000000000000000000000000000000000000000cf0a00000000000000000c000000000000000000000000000000000000000000000000000000000016"], 0x12e)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$UHID_DESTROY(r0, &(0x7f00000000c0), 0x235)
write$UHID_CREATE2(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000008000000000000000000000000000000000000000046beff574fe621bce389802b4100000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a31000000f3ffffffffffffff00"/246], 0x119)
write$UHID_DESTROY(r0, &(0x7f0000000000), 0x4)

15:52:12 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1924.608151][T23159] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1924.624797][T23161] vcan0: tx drop: invalid da for name 0xffff030000000000
[ 1924.846917][T23173] vcan0: tx drop: invalid da for name 0xffffff7f00000000
15:52:12 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffd}, 0x0, 0x100000000000, 0x2}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
r1 = shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
ioctl$SIOCX25SSUBSCRIP(r0, 0x89e1, &(0x7f0000000180)={'hsr0\x00', 0x10201, 0x800001})
creat(&(0x7f0000000000)='./file0\x00', 0x0)
shmat(r1, &(0x7f0000ffd000/0x1000)=nil, 0x3000)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:12 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0xffffffff00000000}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1924.903235][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903347][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903369][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903390][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903412][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903434][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903455][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903477][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903499][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903519][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903548][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903862][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903883][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903904][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903924][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903945][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903967][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.903988][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.904009][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.904030][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.904050][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.904072][ T7617] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0
[ 1924.964205][ T7617] hid-generic 0000:0000:0000.0001: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on s�z1
[ 1924.969965][T23179] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:12 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1925.037434][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.055715][T23195] vcan0: tx drop: invalid da for name 0xffffffff00000000
[ 1925.108126][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236674][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236697][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236728][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236749][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236770][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236790][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236811][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236832][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236852][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236873][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236893][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236914][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236935][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236955][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236975][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.236998][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.237019][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.237040][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.237060][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.237081][ T7617] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0
[ 1925.238851][ T7617] hid-generic 0000:0000:0000.0002: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on s�z1
[ 1925.333083][T23206] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:13 executing program 5:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40186f40, 0x76006e)
setsockopt$PNPIPE_INITSTATE(r0, 0x113, 0x4, &(0x7f0000000040)=0x1, 0x4)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="880000002c00270d00"/20, @ANYRES32=r2, @ANYBLOB="f7ff0000000000000e000000070001006677"], 0x88}}, 0x0)
setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000180)={@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, r2}, 0xc)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:13 executing program 1:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid\x00', 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b00000073797a3119000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100738d7a310000000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a310000000000000000000000000000000000000000cf0a00000000000000000c000000000000000000000000000000000000000000000000000000000016"], 0x12e)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$UHID_DESTROY(r0, &(0x7f00000000c0), 0x235)
write$UHID_CREATE2(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000008000000000000000000000000000000000000000046beff574fe621bce389802b4100000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a31000000f3ffffffffffffff00"/246], 0x119)
write$UHID_DESTROY(r0, &(0x7f0000000000), 0x4)

15:52:13 executing program 3:
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid\x00', 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b00000073797a3119000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100738d7a310000000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a310000000000000000000000000000000000000000cf0a00000000000000000c000000000000000000000000000000000000000000000000000000000016"], 0x12e)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r1, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write$UHID_DESTROY(r0, &(0x7f00000000c0), 0x235)
write$UHID_CREATE2(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000008000000000000000000000000000000000000000046beff574fe621bce389802b4100000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a31000000f3ffffffffffffff00"/246], 0x119)
write$UHID_DESTROY(r0, &(0x7f0000000000), 0x4)

15:52:13 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:13 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x2, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:13 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:13 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x2}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:14 executing program 3:
r0 = syz_open_dev$video(&(0x7f0000000340)='/dev/video#\x00', 0x7, 0x0)
ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000100)={0x9, @raw_data="0376dee1e17e22610d1205cda15d826d430194335521d6fc2f6ca0ee70c565bc045228a199e101e247bd726ddf61f1ccdf000f5a510c8d0ec33926aedc9df0767a9f434ba51761673f2fc9359c62b0037002d4c67a70162f4b7835967813d38de1715e27b6c61cad8a6006593d5b6914ea762e1f26124ad5f2d3b0257df7130cbb222fb303a62cf6b8c402618bf7c83481d610b008818056b7ac24a1947def6301c34039e3740ed1f3476acf146b3530a214fad7f5b00b8c83f83209990cbd714814cd401d821686"})

15:52:14 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:14 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x40, 0x0, 0x0, 0x0, 0x0, 0x1000000003c43, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x102, 0x5}, 0x60189, 0xbf01}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:14 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x8}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:14 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1926.493747][T23236] ubi0: attaching mtd0
[ 1926.496963][T23236] ubi0: scanning is finished
[ 1926.502860][T23235] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1926.515609][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515804][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515828][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515850][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515871][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515893][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515923][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515945][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515966][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.515986][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516007][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516027][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516060][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516080][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516101][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516121][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516141][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516162][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516183][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516203][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516223][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.516255][ T7617] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[ 1926.520318][ T7617] hid-generic 0000:0000:0000.0003: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on s�z1
[ 1926.657206][T23236] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[ 1926.657222][T23236] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 1926.657232][T23236] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[ 1926.657242][T23236] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[ 1926.657253][T23236] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[ 1926.657264][T23236] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 1926.657287][T23236] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 648082834
15:52:14 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x11}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1926.657298][T23236] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 1926.657777][T23255] ubi0: background thread "ubi_bgt0d" started, PID 23255
[ 1926.817314][T23261] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1926.940939][T23269] ubi0: detaching mtd0
[ 1927.116330][T23277] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1927.378579][T23269] ubi0: mtd0 is detached
[ 1927.495294][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.530863][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.539415][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.572903][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.580453][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.608844][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.631631][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.639717][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.666643][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.694020][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.708198][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.734135][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.756886][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.796863][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.812373][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.819826][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.877032][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.917658][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.956833][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.972617][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1927.980093][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1928.018021][T16936] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0
[ 1928.050061][T16936] hid-generic 0000:0000:0000.0004: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on s�z1
15:52:15 executing program 1:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = socket$kcm(0x2b, 0x1, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10)
r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ion\x00', 0x0, 0x0)
ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f00000001c0)={0x20a927, 0x2d, 0x0, <r3=>0xffffffffffffff9c})
r4 = dup(r3)
mmap(&(0x7f000000a000/0x200000)=nil, 0x204000, 0x0, 0x30051, r4, 0x0)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r0, &(0x7f0000007f80)=[{{0x0, 0xe000000, &(0x7f0000000180)=[{&(0x7f0000000000)="94eb98c5f97e2c2a4a02408ccb88a96a52bbf810f9b72aa17225a6c6bcb1f56bc51ce9668fee7066d816af4c6bf88f7adff4c49f3dc6e467603e98d004b63401d6570cf7d036784cb892eb7750", 0x4d}, {&(0x7f00000003c0)="f0583ac29776b175c1e0434c251d2996f169fa34891154de372b60d30b7e13b8a820cc31b4dc8a98236205d5c5329b8482ae7ac5a999d57dc5a723cd5eede9b9edda4b522a6a4a42b8076e488ef139f0baa6bd32babe0c990c66a75c9956b8272a0ba6d52cbc094e996f6cb52e5bb9d2c5abeb1621f359b622fdbbe583c1d262bc28fc4d856e83a3b3cbcfcd83d8ed0c9184f31afac72189b6896a321993fdf79568ee4506113d22bef08fbc36aa5c9cbc600ffedd7d500aa3aa933dddaae7e82eac134d436af91d9a893a262388a7e8c3256a4042a07366998bc11e5884d9853f08f7eebebc4b41323144308cc64ae9913afe5bbed9765b08f447b723eb97199b2fd202ea2017e0cd5efa17f5e993396f29debd1159de0f8836d890b3d81d8cc2a3cf95b0910b6c739928a03a80284dda986c1d6f6899e445b5f8eec34985be9d75447646f44baf1321c3c112971c0caae973a32c05a69f091c9c9622e3e66d2458befc41e72805c8e7349d07e22f890db3d1f1409ef9f2027155844fbd4f7d104e62405dbce5a810181cd05072b94826780b6950180572e93543a736af99858cd6ed71ee4fe722e1e28c2329a6e2f1720bf8fecc96dd3434d6696851845630650548cb8d548a8cde246769913a743257954a8d4d9950ff419c25b5a2db3d817170d0ac70942acbf77bf9746f94bc45a07731ddb9b45d99994a649c3f7f19a75da137f0347babf5df5fea1cccc1392c0434f4cb80164a62e30eebc59f9f53e6f5673ad7753bfb50352ffd9541a943e2a9ac095e8321f7e48223e69398c9fb08429e37aae353cffa23de86fca4f74a5c15aa6d15acbe410341ff99132337400d65e5ab0b19dd7a68a74d69c2b44c7ad7d71e8c480e96c65f31c9bb3f1b1b9bd8a9d9e485cdcb361d5408461bb7eb42d22b8a140cda3239aa5033e57abe392ba62371cb35d49b5abe79587ed299709f542b4a08a72ffae9f488893e257ae1cd0cfc18e124bad5e476a3a18c97c40b571cdb511b69bfe60aad8a9909eb2a639d315b53e2cffcd13d04ca116aa88e90e7ce06658bca74921ee05461ae13076c8c51ae8fbd37eff7d61b8928069a469b1cd5076d9f156e84864e9f729dc8c6b4a967d8188138357a34e5eb1e350e4e4688170b5fa87c78e8a294dbf64d551a1a2e82eba19ac81bcf622a15c754725ae3b38c4240f9f5835aafd8ee6a95a9e83c11e68be8ad5835c49f0f623b168efdb670af3743a2bd64f7ed039f80dd1c9ad1d93d7ba6b43cd91a0339f95969f5bf4468757016f654ee67b07cd34cf60a643ca9e04770005a0025e24dcc14f5f712da46d5909714f73a7a3a64db16efa0b57fdec4acea474a8f5800b1dbbc264608aa6bdbc0cd0a21c2b4c7e7e7f825dc551389686b3e917926a48f1bc6a6695a5de4acc3a966bd33e7014327390db9a158271674a5f3d779195cb4ffc3e185d7b9e95eff5da68e89cdcc2b0bf1f390581f9dcc81db50382c69f811647307db2e033be601fc22a5cfd18679768111d3d8e98bc8f987db0c1911a3b39910d56abdead660cffa1c7e547d7868fb75796393f2748b102d79302e712e4f8e38d986626b2168151b80b32d6f8026831d4d00b52e519c6616711b17f95f4822329c151fc5deb482e98505385dd1fe855ddfed02bfba4caa14a8c0daa7be61d35a59499b02af98bf8ab586ad194229234c6528182e52e7abbb3ca22ed4b5e2e1b144d9a3ed3057b6e2383255e055b7317a96fb4261a48215b4a453d7edf9d11cef2e13dcc798e5b5f27f4a6bac604fe04fab212894888bd035749c91ce42bfbd7fb7df5211f77c42bfae9a077303503c890207ffb987f65b183ecb495fb242ceac7d8b546376b9a8d2f7baf71374a69bfd7cf20692a16d4155dff1a1a00e8b4488ebba6268d15ace5f13a580ab2f8308fbbee8722a77270e5fb7546d4b5493f2247b14aa2e0e4a927ecc8f9f", 0x574}], 0x2}}], 0x400000000000398, 0x0)

15:52:15 executing program 3:
openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x200000, 0x0)
socket$inet6_sctp(0xa, 0x10000000005, 0x84)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0)
r0 = gettid()
perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x800, 0x0, 0x0, 0x0, 0x100}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f0000000140)=""/182)
r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x5)
write$binfmt_misc(r1, &(0x7f0000000dc0)=ANY=[@ANYBLOB="5300000044a6aeabc81e1520000000000000001000fff64017db9820000000000000d403ffff633b27e59aa146175dd106736d173f0fc7ec6e26560000000049d2e181baf9459c5c95394846801d2c0945c08ba8c552fc99a7422007653872ecb4f63acdfe80812d274014ae40b8ae4f2a88d2fbeaec163d6066bb75e16af8ffffffffffffff0627ec60cb274e00da971f7ee096d74c92fad7e34bd5522d45cc36c2442eac2d224609aba9e6000000000200000000000000000000f390d71cc6092cddd3"], 0x155)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r2, &(0x7f00000008c0)=[{0x0}, {&(0x7f0000001040)="827f2117fa2662a64ed52ef5acc6d464fc9a21c455df647bdea6834f774cde1bf3117355d33843fd06076bcade1b70b183c6556e55ac2527a2ea12bce87013b09d14e2c819d367aec4cee7e44ebc7c48360dca0b4854d5526ff0", 0x5a}, {&(0x7f0000001300)="18c93c36b3158e85976303b1bad55140072d4025b55f6e99393f14ad4de209308f67cf0c981709693c50feb42bc25b36c30585f16f6334f8cb7cb262ed447ee0eac26639062d3de2f1af2e9bcab1752751f87d73c9b29c830f7ec838932b50b139cf8ee0abe73b0f8f946d86cb7bdb2b0bf862cb9135e311fd57154ff46ad1fef39212e949946b7aed9659fa94aeee4f541ec8e791fd27185fd5b94cc5167df1b30dda248a7e5feeb5ad3d9a1bf68f94d531985d9e09009962907eeb134d4a9c8bec7cf4162c806f8524e7f735b75a5fa1c43c39ea17432098d515a4a6b9d718e89ff70e33f013db10f9c85dadfc20d4423db488d47e26e3120c0ded179d5e5ae9efe1752b002e0e77b0751786113659f90e04155e3ae04545847f8b768db5b01ab99e09dc041135e4ae5545a589f880b7c37d23e333f711361381efd3d1c27629bb1f1a4b090283ec160553c7f0e461ad862a8c2cace1c6abd9a698dc916622bbd33cc1c244027a85fc528998f802daf73b18db84abeacb66e9092aa417b2388e036fb4358aa59cf1b2f8138d83c1eb15724d8c6eb67e316f033a76f87651648baf9abcafbad371cc5cb06116942d2ea7d767246afc7533597755e75b42cd0a613ea89a0f119300ed3f435d214eadbf26907ba2f748228133dc4e33286cffef9649a749529012c02488fc03e8fa2fc26d10a7b2f61a97a3790e873c08c3334fc19dbf33aaeb784c45b95ae21b0d4a242f4deb7c96ef550e73f38e1c9bd688823815021589b40e1888428b86f6406cd020cc3d645e4a59bd5b0c5140576271699367619206ab4dcb78e5d74fd6b8207ef272f12de5575256583e86f6acf3e1fd2ae9bcdea2ba31792aaf8b616e2dd16d4ffcf9f22031de3cb99aa9a06ca1299242c748b0f38d14271b649d34ecff4e763e13f5df176a837018a415e6570c64abae7bac54baab986fe19d9e04276d9da25c0922646f4c3ee3f09494448d664667fd36b8120ca60c04c8c7fd2063366dd803c30939cff2229057038e38c7f34ca1513979c43762c30f178cd7e3e217bb530e5e31384779a97296ddd5c11a65ece3cf4835313156084d50b6a8a333985709805afb5e3daa85dbddc3a46e2f65a9d511ab4202a9165fdb325aeac4d3f5362947744eec2dccd4a6ee9ee63240ce59546f17db7155722669b72369fe3d7836b4a648ef36102c8e5fd785d3eeed3413096ed3e71d2d1366c907ce560c07e24cda0c2fff1b18820076fda93a02ef23deeb27ee06d5f63267c2eb0fdf4f296422e056c0ea2be4eb9f4b3a9c537106af7578325d2e40e91aed6f871df7dcd63c6d1231d908d8009c72444887367b958e8f597699cae4a872c6c3df431e2c3d8f413ea316123cbdf67172eed1f1a238166ffbdb73783ec3758e134350161cbc89de62139fc6e77ab59432135203cf59347b4603a91be1f31aea75ce473eeb56489394bb376da02ea68962c4a69e04e500a3b84828f50a6fd1ab731a2021c5bcdd25d0668c4e394acb9792b7818e1330d3e5cc73eebea17d3f8df82feaa1ce2c6f90c76517cad18bed169f783f6072c171c7f852667b99218979d4183268eefc375942575a507e0d8221d9bd96eaf1e3906485f00e4588d0269b88b9892f31435bf4ffb7655365204ff0c2ce3c5037b29bcdb548b852f0d631b6173112ec2a2a262e68ea248a13983b7045ae0d13a3cfb73998fceeb7ab9332159df3d4e9a5a967fcdf566f8ceb1687ae805d89e38ace66228405ebc605cad21e8dd68b06dea2868dad0fd1538fa946e5a7b758366e2820348dddbff38193132476d0b2562a3cf7d6d84f250d8a2d31fdda0a628bcb529daf91ca734979463aab5229c2c7023b53d9a77c5161c5fd91620276a959e8b8097e7609df51859c0edaaf1e8e64712aeb27f32ba427051a26b124d604acbb33185360109b48fb28933a665621e2940a197a47534dc4b944a7645698bda09854a50d6aee995cf9946c5e5334a85abee719baabf93ffa7255a5cd89269fbb70ff9db0641792d6a8d846b9a7e6383b8eafe94f74fd37ee631d65918d9d0401da5f3e309c3bd241b727fe057813041a1b861c9245c7fb0ad02e93a913462dd7d8c9885224ce5d45821d7d49998f3dd90ceff1467944f016abf0691e592a2afd0c8d17ffbf0a3e113ca996b66dc4af340daa96326667e598f41d06576dfe062decb9cc504d721a0ab6fcf3f4dd1d298fc85b94dc52a7ddb00770b8ac99231b640018aa4fb51af490243a8ca5a5538dc51571976b9215d0c7cc3a3140ed01215dbea5a6322a9d46851a20059c7f6b14f00304c7ac0e987d3b76a2b2f6fe0df425c794add1c26f4858338aef1a7f77b9825d76797573f73dd2a7c42cff15d4c3bb8b91cce62d99b8e178b1e39dfc74c76de7e09064167be2646196eee631e646aafcff77e1a1da79d110ec963aaabf06f2fd11b98187f68b514f3a48d8c20efdf5fdaceaa183530c84daf6c91c629c765e1a33bd880a8921c265d20d3f17d6e0748ba7bda78e3196e1eddca7814f6b17552733bb80e9e39452a9781adb647ad85203c5e42e2e551f912c2632a34b41e7abd753b5aca7bcfe06203daa73526601b35e2e7e18e23e6ee27bda8e46832529f90687a6575e866e84396b20335dfd89fbee35a625495208515bdf5fa7119f584c9ab57c7e824faad1b24b1de0a6e2f6e043a0b3587782e1f682b14e0420c0d4f6611a6e544e14d00d55c5edf29028d0a13b66f5ef7f5348c26fb59fdc1da43934e677b9c011d2c0bdfc9e630773012083a10033f174b1c4de8cf5d0553d52c8dab51579be34ef9e3215b751edd267609e47a31e236f205285e6bb989c0c6a69bbdc1766969bc34e7eda80c353420257e75eb7e3219f9c60ca9bac8cb52550116e2475f631a4c61ffafe536d341f546cf1b4666357bbbc254c79a87e92ef6894f4d9205729f62a5fefbfc0d046ea7819bf745fa6da7a040180239d8744038f400da34f75f75cd25519d3e4f8e770ae2336871e8665629d97aa2dcf218df80c3296a684680d8c2febfc6e6237cca617cd44066606c9f09c5960cda540fbfecf71bf3cd77c06005433e9673a5ee8273b25d50f0b69236f42a5f547e16a93451deee513d3d28705501a14fda1f68ddd3f02f7d98ca9e35d5857dbdd013ae27288f2248869ad4289f1ec3b813febce623178906f63e73c2e7d47d1bd05d1d1648be9bd15c019911bacf3f94912baae71cf26f44da9fd943053a4c630bd1dc0c80a703fc7ee1cf99d8101c1608993bd9b6cfa0e6d9c57980b1e972fe6958d17f425476a036ee7eb4e470e7487c28040a1ec5e92a0c3c2db7d02af3ae589dc33e361d733f332e7b0649cc7675331dd9e1ae304ccb461f60428f3b443f67a66485388034b69429e7049f7ef412348ab8607d05f365b8ab39762abc01723a106820e8dc3a498bc13ad86eea27a9e78199262ff83cfeebaef5e456f37aec3f581e10e51352c5cb563c8a9ddc6df606714c791ce18dc1bbaf91bda0da176f45c49072d368c9cad550a2b3308290926fbe2e1c5696935c43cc225c46be86eeccf430b8f3728d9abddb73551ff8a9c97abf761fa352d25230ab098e5646f63afe8eed852aa040d6b06690f66f111a06594c491c2e98e1240fae090ab61608eb731ded0106447af23e75a8c88aa51ade63883607e54c48e0d2292560ba1ccf430205f8dab0aa83aa9075a5e9ecb8189baa9dc1f353b4836ebd754874cc4676214dfe602ef2c522841ab929bcb48edb29764af859cc07ab8b1cd9a5a2c6f4469e9a1da9aee9cc43856b3b4a9c2c29b7fd8f4e8f0fa274d37043e968eb2886fc61725bd1c21a20c261f63b24b319a880b92bcddf2903187bc4ae21bc5654188f4af82f40dd4c365bf6183c7864ac50a10d82b28ef1efa7a9203b31ffbc88d68f7af67f6e0b03628a60c4142c27af75450a94ab86a47b50c38e515002778f6f4d27e013e3c7fe81a41f9f692b5e9ff786c04a575cc1855a2dd9914eac767beccefa2a077371ab40d167bee3d6982979ce1cda200410188f5b7130b248909cf7c0fb2b709e7eb6812d94e26b4ad03ff9b1606ebced05cd2fef6e3a69c8ab14292b246d869a529a57a102507d1f1094d86c8eba79d826fea3ac0c498449eb96377d448247ca4aae32a7d2698b9e8a23be3cb2c6ae27c874d2e65fc198e31ac71fd8008b427cb52d25b406aebeefa2a79efc2f7f4c4d800256ec1871568db3fe5de7f86f904317a937df1fee95265bd5582ac3d5a08fcdd33f9c049151b29320adc2eb2dead377de19f124e1761a5e96b07066fc8f958df33061661fca08831b1a618462a2cc6bc7ce168ee48ddaa053fd5553a93c9cf0b98c536fbf2116cc38a766dc94eaca202a5f25033a4401dcf90c8f3ea84813ca084e9d2523d1302d46b0589b110ae8f782a62a095cb407588946c13baa919041c198e36e4febf991172624afff5c3217b61df69fc4db6037bc3e3f7460a6a2b8eb7b7bb0a05987c5369dc3df9ca77ade6b79a5ea81f24cc480b105e0dcb85faf96f71389fb8efc48a6e2f13eb8bf78e863087d76d56772dfd2efab82ae5d35c069b084617be723bbf92dc03a2def7b304534eaf6d1ab033232d9875e3367ea0f1f44c2ebf99447fd401bf6c4e17f5f798a26b5074febeddeccd8ab5229acfa85eca19a351e5a5132d59311f2b2ce51bfbec5a257a1348d223babd39d5231cbdf843392c4a0a0e43eb8e3384d82fa09d93715726bac3785b31ce9b4e98f13dcb9d7d37f50352a008ab3887775ae1643172c92af61495008df929bbafd4697bf545846347b596f2b86c7c66ea14f9e698ec375a872c76b4a8998adf67ef74c2dc761e3e797ee7151dc148b28597be4185df9bcd33a9486f1a13f04aa9dff90b7936db6ead69cca82e9cc41bc31617b371630b48c05e5366f2c3258435feba5c546084266b7e09e128708fe14090938bfd0281ab2e4ee8b07c89455ac8aa3f60669d3f131348b2b86a969b01e1995fda29841c7273c67882e6bab7ccecd730947d44c7086869022f6b4ee94e93694a66217bb90a848f3fe0d08d1c1b2913ef05e54169aee23ae3ee87b8013a4332d9559651753538169c6fcc996d3a70dfe02b7ed08d31a13bd5edaa650efc4d2d4628baad3d90860d65f88973b33ff740543a446579e08bf2b41d313fa04101d90030377226ed51909340f8f742d2a07eddc9f230b16d567a3de377330ff7a8b59c17c481686e721ebe05e4ae893b9c0919fae209c96d2070bc4a43851979fbb98e8883a4997c0378a94230c208d7d66d301bd08af2412dbf1dec7765266f832bc2dcd7b53fee23b9340c5cec5387284bfbbf19b4ba3cb633e66403e56582539222ed471e379dbb326d7f0176a7fa0ead1f5ad498f554122cb63d0c55e9cbb877cebf1aadcc9e75bfe0302d9a48a178783da66cbc83002242027a9f626a20bd070aa3093990181bfdeb1711b450761d7ab07a468b9da4f4d15a1c43cd59da8888d5d8c4203cdea59ffab2d978f0c31fe8fdee8785c7e0e16cb27925e2a5d26a2426703531c09e5a9f3a8740ecfcd91625f5be287bac53375b9fd62b862bc6aacf1e7a5c6387d82719f2991446ce5e909af267b542b95e72c5bec7b01d3601967e6e4b6dab33bf81b5704a446d41c84d653483ce0807e031996a62aead29f3eccf54c80708e57a6ea373c68502448d5ff8ed9f52f5f4b96d0ace52cda59ed81fe68d809fb582ede6fea20078f3300e614c9e9b23238ce40688db9b1bc6", 0x1000}], 0x3)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040))
ptrace$setopts(0x4200, r0, 0x1f, 0x10)

15:52:15 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x3, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:15 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:15 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:15 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
inotify_add_watch(r1, &(0x7f0000000180)='./file0\x00', 0xc10)
ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000040))
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/nvram\x00', 0x185200, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000200)={0x0, 0x4, 0xc2, 0x9, 0x4}, 0x14)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1928.216851][T23313] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:15 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x2}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:15 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1928.237901][    C1] sd 0:0:1:0: [sg0] tag#5126 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s
[ 1928.237938][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB: Test Unit Ready
15:52:15 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x8}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1928.237971][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238000][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
15:52:16 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000040)=@generic={0x2, 0x5, 0x3})
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

[ 1928.238028][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238055][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
15:52:16 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1928.238082][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238109][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
15:52:16 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x11}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1928.238137][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238165][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238198][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[80]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238266][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[90]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238318][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[a0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238345][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[b0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1928.238372][    C1] sd 0:0:1:0: [sg0] tag#5126 CDB[c0]: 00 00 00 00 00 00 00 00
[ 1928.600089][T23332] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1929.042173][    C0] sd 0:0:1:0: [sg0] tag#5127 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s
[ 1929.042210][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB: Test Unit Ready
[ 1929.042243][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042274][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042305][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042335][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042366][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042397][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042428][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042458][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042488][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[80]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042518][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[90]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042548][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[a0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042577][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[b0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1929.042607][    C0] sd 0:0:1:0: [sg0] tag#5127 CDB[c0]: 00 00 00 00 00 00 00 00
15:52:17 executing program 1:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x80}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x0, 0x2, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x20000041)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x100000000, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00')
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42800)
clone(0x50000103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)

15:52:17 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:17 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:17 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$VIDIOC_CROPCAP(r0, 0xc02c563a, &(0x7f00000003c0)={0x4, {0x9, 0x4, 0xb7a, 0x3ff}, {0x9, 0x1, 0x8}, {0x0, 0x7c96}})
write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000300)={0xc, 0x8, 0xfa00, {&(0x7f0000000180)}}, 0x10)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r2 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r2, 0x80184132, &(0x7f0000000400))
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, &(0x7f0000000040))
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000440)='./file0\x00', 0x80)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:17 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x81)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000580)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b75fb3488fd8015bba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377aba09e7b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10000174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d41f6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28b774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a800655d127de6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"})
r3 = dup3(r0, r1, 0x0)
ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0x4400ae8f, &(0x7f0000000000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x8, 0xfdfdffff]})
dup2(r3, r2)
r4 = socket$inet6(0xa, 0x1, 0x0)
r5 = dup(r4)
ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200)

15:52:17 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x4, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:17 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:17 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:17 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x81)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000580)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b75fb3488fd8015bba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377aba09e7b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10000174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d41f6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28b774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a800655d127de6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"})
r3 = dup3(r0, r1, 0x0)
ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0x4400ae8f, &(0x7f0000000000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x8, 0xfdfdffff]})
dup2(r3, r2)
r4 = socket$inet6(0xa, 0x1, 0x0)
r5 = dup(r4)
ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200)

[ 1930.189488][T23378] kvm: vcpu 129: requested lapic timer restore with starting count register 0x390=4241646265 (4241646265 ns) > initial count (296265111 ns). Using initial count to start timer.
15:52:17 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x8}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:17 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, 0x3, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000084}, 0x94)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:17 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1930.516196][T23403] kvm: vcpu 129: requested lapic timer restore with starting count register 0x390=4241646265 (4241646265 ns) > initial count (296265111 ns). Using initial count to start timer.
[ 1930.694231][T23415] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1930.968538][T23426] IPVS: ftp: loaded support on port[0] = 21
15:52:18 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
r5 = dup(r4)
ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:18 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x5, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:18 executing program 3:
clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x3e, 0x0)
write$nbd(r0, &(0x7f00000000c0)={0x6000000, 0x0, 0x0, 0x0, 0x2, "a3ef07749fa55f625aa6af3c7307f2179cba335a2fd5ede515d502000000feffff63af872a0a18ecf6449fe66884b33c61b3927917b2d8ef665ad9b19f55dd7d020a724232a8b58e9eb39b463929bef2c468429967c5e7be"}, 0x68)

15:52:18 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x11}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:18 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
ioctl$VIDIOC_G_FREQUENCY(0xffffffffffffffff, 0xc02c5638, &(0x7f0000000040)={0x9, 0x1, 0xff})
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:18 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:18 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
r3 = dup3(r1, r2, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000000)=0x2e0, 0x4)
ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x48], 0x0, 0x7ff, 0x5b3})

[ 1931.198859][T23456] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1931.209342][T23460] dlm: no locking on control device
15:52:18 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:18 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:18 executing program 3:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x80}, 0x0)
ptrace$getsig(0x4202, 0x0, 0x0, &(0x7f0000000200))
recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x0, 0x2, 0x0)
pipe(&(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x0)
sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x20000041)
fcntl$setpipe(r1, 0x407, 0x0)
ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0)
openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/snd/timer\x00', 0x40)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x488c, 0x4, 0x0, 0x0, 0x7, 0x0, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x100000000, 0x0)
r2 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r2, 0x4, 0x42800)
clone(0x50000103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)

[ 1931.231318][    T7] tipc: TX() has been purged, node left!
15:52:18 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:18 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x3f, 0x0, 0x0)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
r3 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x5, 0x0)
ioctl$VIDIOC_TRY_FMT(r3, 0xc0d05640, &(0x7f0000000240)={0xa, @raw_data="792fa37ee1cafce665895156b4ad1d4b340706f9d86fa1bcaf593391d3ad4a22028018c715ab76d72f5c36b6e07215875d6ddde1c318bd66a2426fc3aab1f413fa131dcc9b896a18df478cd4b0b3a28521d2a805f5f01f58b320a5b9ae5e002ff499f6ebafdaf2856f3033bf78e528408c70a55b9ef578a556fff4af508868a691bf5ef3a89abc517bb4d348bd8f26799091e6b79fb2e35f1a072c8972f14848de612950876ef94de2123785d508e7235645e6c5c1f1a3ba87253ae20d92153a103679b516484a62"})
ioctl$ASHMEM_GET_SIZE(r1, 0x40046f41, 0x76006e)
ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000040)={<r4=>0xffffffffffffffff})
getsockopt$inet_dccp_buf(r4, 0x21, 0xe, &(0x7f0000000180)=""/20, &(0x7f00000001c0)=0x14)

[ 1931.654980][T23485] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1931.714542][T23486] IPVS: ftp: loaded support on port[0] = 21
[ 1932.433166][T23525] IPVS: ftp: loaded support on port[0] = 21
[ 1932.791438][T23548] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
[ 1932.901036][T23548] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:21 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
r5 = dup(r4)
ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:21 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x6, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:21 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x8}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:21 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:21 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0xc8, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:21 executing program 3:

15:52:21 executing program 3:

15:52:21 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:21 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x11}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1933.938061][T23563] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:21 executing program 3:

[ 1934.197444][T23576] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:21 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:21 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1934.457209][T23590] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1934.714080][T23602] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
[ 1935.050867][    T7] tipc: TX() has been purged, node left!
15:52:22 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
r5 = dup(r4)
ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:22 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x7, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:22 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)
semget$private(0x0, 0x4, 0x20)

15:52:22 executing program 3:

15:52:22 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {}, 0x2}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:22 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
fcntl$dupfd(r3, 0x0, r3)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:22 executing program 3:

15:52:22 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {}, 0x8}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:22 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
fcntl$dupfd(r3, 0x0, r3)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:22 executing program 3:

[ 1935.199983][T23619] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1935.213446][    T7] tipc: TX() has been purged, node left!
15:52:22 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000018c0)={0x4, <r4=>0xffffffffffffffff})
dup2(r1, r4)
ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000040))
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:22 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x8, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1935.567165][T23639] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1936.005506][T23655] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:24 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
r5 = dup(r4)
ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:24 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {}, 0x11}, 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:24 executing program 3:

15:52:24 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
fcntl$dupfd(r3, 0x0, r3)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:24 executing program 5:
perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x3c43, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, @perf_config_ext={0x4}, 0x5c88c, 0x0, 0x0, 0x5, 0x2, 0x801, 0xfffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
r1 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000000280)={0x80000000, 0x2000000, 0x0, {0x3, 0x9}, 0x1, 0xfffffff7})
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8983, &(0x7f0000000040)={0x7, 'caif0\x00', {0x9}, 0x4})
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
sendmsg$IPSET_CMD_SAVE(r2, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x8, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0)
r3 = openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0xd0080, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(r3, 0x0, 0x0)
ioctl$VIDIOC_G_JPEGCOMP(r3, 0x808c563d, &(0x7f0000000180))
openat$fuse(0xffffffffffffff9c, &(0x7f0000000240)='/dev/fuse\x00', 0x2, 0x0)

15:52:24 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x10, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:24 executing program 3:

15:52:24 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x17, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

15:52:24 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840))
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:24 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r0, 0x40046f41, 0x76006e)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000340)={0x0, 0x0, 0x1, {0x0, 0x7fffffff}, 0x6, 0xff})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78)
shmget(0x3, 0x2000, 0xff0fb7da81a21427, &(0x7f0000ffc000/0x2000)=nil)
ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000040)=0x3)
preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0)

15:52:24 executing program 3:

15:52:24 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x20000b58, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}}, 0x0)

[ 1937.172274][T23672] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1937.465648][T23688] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1938.399216][T23712] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:25 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
dup(r4)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:25 executing program 3:

15:52:25 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840))
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:25 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x280, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:25 executing program 5:

15:52:26 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x2}}, 0x0)

15:52:26 executing program 3:

15:52:26 executing program 5:

15:52:26 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x300, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:26 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x8}}, 0x0)

15:52:26 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840))
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:26 executing program 3:

[ 1939.004562][T23742] __nla_validate_parse: 1 callbacks suppressed
[ 1939.004573][T23742] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1939.511782][T23758] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:26 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
dup(r4)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:26 executing program 5:

15:52:26 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x500, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:26 executing program 3:

15:52:26 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0xf}}, 0x0)

15:52:26 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:27 executing program 5:

15:52:27 executing program 3:

[ 1939.668979][T23768] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:27 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x300}}, 0x0)

15:52:27 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x600, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:27 executing program 5:

15:52:27 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

[ 1939.965937][T23788] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1940.465440][T23804] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:27 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x6fffff9}}, 0x0)

15:52:27 executing program 3:

15:52:27 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x700, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:27 executing program 5:

15:52:27 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
dup(r4)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:27 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:27 executing program 3:

[ 1940.598647][T23814] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1940.614595][    C1] vcan0: j1939_xtp_rx_abort_one: 0x0000000020ac4589: 0x00000: (2) System resources were needed for another task so this connection managed session was terminated.
15:52:28 executing program 5:

15:52:28 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x20000141}}, 0x0)

15:52:28 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x2000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:28 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:28 executing program 5:

15:52:28 executing program 3:

[ 1940.895748][T23832] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:28 executing program 5:

15:52:28 executing program 3:

15:52:28 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x7ffff000}}, 0x0)

[ 1941.477081][T23856] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:29 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:29 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x4000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:29 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:29 executing program 3:

15:52:29 executing program 5:

15:52:29 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0xfffffdef}}, 0x0)

15:52:29 executing program 3:

15:52:29 executing program 5:

[ 1941.832150][T23870] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:29 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x8002, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:29 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0xffffff1f}}, 0x0)

15:52:29 executing program 3:

15:52:29 executing program 5:

[ 1942.349959][T23893] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:30 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:30 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0xff00, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:30 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x2}, 0x0)

15:52:30 executing program 5:

15:52:30 executing program 3:

15:52:30 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:30 executing program 3:

15:52:30 executing program 5:

15:52:30 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0xff01, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:30 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x8}, 0x0)

15:52:30 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:30 executing program 5:

15:52:30 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:30 executing program 3:

15:52:30 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0xf}, 0x0)

15:52:30 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0xff7f, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:30 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:30 executing program 5:

15:52:31 executing program 5:

15:52:31 executing program 3:

15:52:31 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x300}, 0x0)

15:52:31 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:31 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x1000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:31 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mlock2(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)

[ 1944.043631][T23968] __nla_validate_parse: 2 callbacks suppressed
[ 1944.043652][T23968] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:32 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
msgget(0x2, 0x201)

15:52:32 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x6fffff9}, 0x0)

15:52:32 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:32 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x2000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:32 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:32 executing program 5:

15:52:32 executing program 5:

[ 1944.736229][T23989] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:32 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x20000141}, 0x0)

15:52:32 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x3000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:32 executing program 3:

15:52:32 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:32 executing program 5:

15:52:32 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, <r1=>0x0}, &(0x7f00000001c0)=0xc)
msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000580)={{0x0, 0x0, r1}})

15:52:32 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x7ffff000}, 0x0)

15:52:32 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x4000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:32 executing program 5:
syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0)
r0 = syz_open_dev$dri(0x0, 0x0, 0x0)
flistxattr(r0, &(0x7f0000000200)=""/236, 0xec)

[ 1945.031048][T24011] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:33 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:33 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r2=>0xffffffffffffffff})
r3 = fcntl$dupfd(r2, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:33 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x5000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:33 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0xfffffdef}, 0x0)

15:52:33 executing program 5:
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$int_in(r0, 0x5452, &(0x7f0000000100)=0x6)

15:52:33 executing program 3:
syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0)
r0 = syz_open_dev$dri(0x0, 0x0, 0x0)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c)

[ 1945.812565][T24040] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
[ 1945.901542][T24051] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:33 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0xffffff1f}, 0x0)

15:52:33 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0)
r0 = syz_open_dev$dri(0x0, 0x0, 0x0)
ioctl$FITHAW(r0, 0xc0045878)

15:52:33 executing program 5:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x6c, 0x6c, 0x4, [@ptr, @restrict, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{0x10}, {0x0, 0x1}, {0x0, 0x3}, {0x0, 0x3}]}, @var, @array]}, {0x0, [0x0, 0x0]}}, 0x0, 0x88}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
tkill(r0, 0x40)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

15:52:33 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x6000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:33 executing program 2:
r0 = socket(0x0, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:33 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x7000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1946.196129][T24078] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1946.538906][T24091] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:34 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:34 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x2}, 0x0)

15:52:34 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0)
r0 = syz_open_dev$dri(0x0, 0x0, 0x0)
ioctl$FITHAW(r0, 0xc0045878)

15:52:34 executing program 2:
r0 = socket(0x0, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:34 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x8000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:34 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x10000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:34 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000000)=""/64)

[ 1946.987379][T24109] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:34 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x8}, 0x0)

[ 1947.516969][T24133] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:36 executing program 5:
perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x240}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f0000000240)='./file0\x00', 0x0, 0xa51000, 0x0)
r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0)
r1 = openat$cgroup_procs(r0, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0)
writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)='0', 0x1}], 0x1)

15:52:36 executing program 2:
r0 = socket(0x0, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:36 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x11}, 0x0)

15:52:36 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x20000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:36 executing program 3:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x7e, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f0000000280))
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0)
ioctl$DRM_IOCTL_MODE_MAP_DUMB(0xffffffffffffffff, 0xc01064b3, 0x0)

15:52:36 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r3 = socket$packet(0x11, 0x3, 0x300)
r4 = dup(r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:36 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x40000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:36 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0xee}, 0x0)

[ 1949.216870][T24149] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:36 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xa4, 0xa4, 0x4, [@array, @var={0x0, 0x0, 0x0, 0xe, 0x2}, @ptr, @typedef, @typedef, @enum={0x0, 0x5, 0x0, 0x6, 0x4, [{}, {}, {}, {0x0, 0x1}, {}]}, @ptr, @func, @typedef]}, {0x0, [0x0, 0x0]}}, 0x0, 0xc0, 0x0, 0x2}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
tkill(r0, 0x40)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

15:52:36 executing program 5:
creat(&(0x7f00000002c0)='./bus\x00', 0x0)
r0 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002011, r0, 0x0)
timer_create(0x0, &(0x7f0000000100), 0x0)

15:52:36 executing program 2:
r0 = socket(0x1000000010, 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:36 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x80020000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:36 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x1100}, 0x0)

[ 1949.491563][T24173] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:36 executing program 2:
r0 = socket(0x1000000010, 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:37 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x3f00}, 0x0)

15:52:37 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x0}, 0x68)

15:52:37 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0xff000000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1949.768243][T24196] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:37 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r3 = socket$packet(0x11, 0x3, 0x300)
r4 = dup(r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:37 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0xff010000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:37 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0xee00}, 0x0)

15:52:39 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x50, 0x0, 0x0, 0x0, 0x0, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xffffffff}]}, 0x50}}, 0x20000000)
semop(0x0, &(0x7f0000000100), 0x2d)

15:52:39 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0)
fallocate(r0, 0x11, 0x0, 0x10000)

15:52:39 executing program 2:
r0 = socket(0x1000000010, 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:39 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0xefff}, 0x0)

15:52:39 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0xff7f0000, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:39 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r3 = socket$packet(0x11, 0x3, 0x300)
r4 = dup(r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:39 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0xffef}, 0x0)

15:52:39 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

[ 1952.582120][   T29] audit: type=1800 audit(1594482759.919:265): pid=24241 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=15794 res=0
[ 1952.604895][T24242] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:40 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000080))

15:52:40 executing program 5:
perf_event_open(&(0x7f00000012c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(0x0, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff)
clone(0x3a3dd4008400af81, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:40 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x0, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:40 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x34000}, 0x0)

15:52:40 executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x2})
r1 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x891c, &(0x7f0000000180)={'syzkaller1\x00'})

15:52:40 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe(&(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
write$P9_RATTACH(r0, &(0x7f0000000100)={0x14}, 0x14)

15:52:40 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x0, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:40 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x3ffff}, 0x0)

15:52:40 executing program 5:
r0 = msgget$private(0x0, 0x0)
msgsnd(r0, &(0x7f0000001500)=ANY=[@ANYBLOB='M'], 0x2000, 0x800)

[ 1952.835123][T24267] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables
[ 1952.835401][T24267] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1952.928562][T24271] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1953.251194][T24295] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
15:52:41 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r3 = socket$packet(0x11, 0x3, 0x300)
r4 = dup(r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:41 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x400300}, 0x0)

15:52:41 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
socket$inet6(0xa, 0x2, 0x0)
tkill(r0, 0x40)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)
ptrace$cont(0x18, r0, 0x0, 0x7)

15:52:41 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000240)=ANY=[], 0x20)

15:52:41 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x0, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:41 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:41 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb4, 0xb4, 0x3, [@array, @restrict, @func_proto, @union={0x0, 0x7, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @fwd, @array]}, {0x0, [0x0]}}, 0x0, 0xcf}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x40)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

15:52:41 executing program 5:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000080))

15:52:41 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0xee0000}, 0x0)

15:52:41 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:41 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x1000000}, 0x0)

15:52:41 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
clone(0x3a3dd4008400af81, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

[ 1953.995906][T24331] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1954.265120][T24364] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1954.344722][T24373] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1954.499592][T24378] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:42 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r3 = socket$packet(0x11, 0x3, 0x300)
r4 = dup(r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:42 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x2000000}, 0x0)

15:52:42 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
clone(0x3a3dd4008400af81, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:42 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:42 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x1e0, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:42 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
clone(0x3a3dd4008400af81, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

[ 1955.074605][T24397] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1955.086015][T24398] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1955.207642][T24410] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1955.487963][T24417] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:44 executing program 3:
perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1)
r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2)
recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000100)=""/16, 0x10}], 0x1}}], 0x1, 0x0, 0x0)
readv(r0, &(0x7f0000000080), 0x200000000000029c)
sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$int_in(0xffffffffffffffff, 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x800)
getsockname(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x0)
write$evdev(r0, &(0x7f000004d000)=[{{}, 0x0, 0x1}], 0xfffffe82)

15:52:44 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x8000000}, 0x0)

15:52:44 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
clone(0x3a3dd4008400af81, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:44 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:44 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r3 = socket$packet(0x11, 0x3, 0x300)
r4 = dup(r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

15:52:44 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:44 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
clone(0x3a3dd4008400af81, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:44 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x11000000}, 0x0)

15:52:44 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:44 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
clone(0x3a3dd4008400af81, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:44 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
clone(0x3a3dd4008400af81, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:44 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0x3f000000}, 0x0)

[ 1957.189530][T24441] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1957.217742][T24443] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1957.467754][T24462] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1958.731420][T24486] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
15:52:48 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
sendmmsg$inet(r0, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000000140)=[@ip_retopts={{0xc}}], 0xc}}], 0x1, 0x14)

15:52:48 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:48 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0xfdffffff}, 0x0)

15:52:48 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:48 executing program 4:
syz_open_dev$audion(0x0, 0x0, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0)
sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x480, 0x2, 0x0, 0x0, 0x0, 0x4})
socket$netlink(0x10, 0x3, 0xc)

15:52:48 executing program 1:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
r4 = socket$packet(0x11, 0x3, 0x300)
r5 = dup(r4)
ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200)
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x64, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{}, {}, 0x0, 0x20}}, @TCA_TBF_RATE64={0xc, 0x4, 0x84fc95840eb0a0c7}]}}]}, 0x64}}, 0x0)

[ 1961.027774][T24506] xt_CT: You must specify a L4 protocol and not use inversions on it
15:52:48 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
getdents(0xffffffffffffffff, &(0x7f0000000100)=""/164, 0xa4)
r2 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:48 executing program 3:
creat(&(0x7f00000002c0)='./bus\x00', 0x0)
r0 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002011, r0, 0x0)
mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0)

15:52:48 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0xffef0000}, 0x0)

15:52:48 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000001840)={<r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:48 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:48 executing program 0:
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1}, 0x18)
sendmsg$can_j1939(r0, &(0x7f0000000100)={&(0x7f0000000b40), 0x18, &(0x7f0000000b80)={&(0x7f0000000140)='*', 0x1}, 0x1, 0xffff0300}, 0x0)

15:52:48 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0)
perf_event_open(0x0, 0x0, 0xffffdfffffffffff, 0xffffffffffffffff, 0x0)
lseek(r0, 0x800002, 0x0)
ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0))
write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x1)
fallocate(r0, 0x3, 0x0, 0x8020003)
write$binfmt_aout(r0, &(0x7f00000002c0)=ANY=[], 0x1)
lseek(r0, 0x0, 0x3)

15:52:48 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
dup(r0)
r1 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

15:52:48 executing program 2:
r0 = socket(0x1000000010, 0x80002, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x3, 0x0, 0x0)
r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010000507000000000000040000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14, 0x2, [@TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_MASK={0x6}]}}]}, 0x44}}, 0x0)
sendmmsg$alg(r0, &(0x7f0000000200), 0x10efe10675dec16, 0x0)

15:52:48 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
dup(r0)
r1 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0xf0, 0xf8, 0x208, 0xf0, 0xf8, 0x200, 0x208, 0x208, 0x200, 0x208, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a], 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@icmp6={{0x28, 'icmp6\x00'}, {0x0, "8c6f"}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330)

[ 1961.065045][T24509] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1961.253873][T24520] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1961.319415][   T29] audit: type=1804 audit(1594482768.649:266): pid=24524 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir086486805/syzkaller.v3FvlY/1514/bus" dev="sda1" ino=16361 res=1
[ 1961.383054][T24528] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1961.454514][T24535] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1961.592360][T24546] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1961.670791][T24549] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1961.731567][T24556] xt_CT: You must specify a L4 protocol and not use inversions on it
[ 1961.855052][T24561] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'.
[ 1962.026381][ T7317] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
[ 1962.026393][ T7317] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[ 1962.026409][ T7317] CPU: 1 PID: 7317 Comm: syz-executor.4 Not tainted 5.8.0-rc4-syzkaller #0
[ 1962.026417][ T7317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1962.026441][ T7317] RIP: 0010:__switch_to_asm+0x0/0x40
[ 1962.026457][ T7317] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1962.026464][ T7317] RSP: 0018:ffffc90007837bb0 EFLAGS: 00010046
[ 1962.026476][ T7317] RAX: dffffc0000000000 RBX: ffff8880ae735e18 RCX: 0000000000000000
[ 1962.026485][ T7317] RDX: 1ffff11015ce6bc2 RSI: ffff88809269e500 RDI: ffff88805486e280
[ 1962.026493][ T7317] RBP: ffffc90007837c80 R08: 0000000000000001 R09: ffff88805486eb48
[ 1962.026501][ T7317] R10: fffffbfff155cb69 R11: 0000000000000000 R12: ffff8880ae735e00
[ 1962.026510][ T7317] R13: ffff88805486e280 R14: ffff88809269e500 R15: ffff88805486e6b0
[ 1962.026521][ T7317] FS:  0000000001139940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
[ 1962.026530][ T7317] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1962.026538][ T7317] CR2: 00000000256a8ea8 CR3: 000000004874b000 CR4: 00000000001426e0
[ 1962.026549][ T7317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1962.026557][ T7317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1962.026561][ T7317] Call Trace:
[ 1962.026580][ T7317]  __schedule+0x8e1/0x1eb0
[ 1962.026599][ T7317]  ? io_schedule_timeout+0x140/0x140
[ 1962.026613][ T7317]  ? _raw_spin_unlock_irqrestore+0x62/0xe0
[ 1962.026628][ T7317]  schedule+0xd0/0x2a0
[ 1962.026644][ T7317]  do_nanosleep+0x222/0x650
[ 1962.026657][ T7317]  ? find_held_lock+0x2d/0x110
[ 1962.026674][ T7317]  ? schedule_timeout_idle+0x80/0x80
[ 1962.026689][ T7317]  ? __free_object+0xdd0/0xdd0
[ 1962.026704][ T7317]  ? memset+0x20/0x40
[ 1962.026718][ T7317]  ? __hrtimer_init+0x12c/0x260
[ 1962.026733][ T7317]  hrtimer_nanosleep+0x1f6/0x430
[ 1962.026747][ T7317]  ? nanosleep_copyout+0x100/0x100
[ 1962.026759][ T7317]  ? _copy_from_user+0x138/0x190
[ 1962.026774][ T7317]  ? hrtimer_init_sleeper_on_stack+0x90/0x90
[ 1962.026790][ T7317]  ? put_timespec64+0x120/0x120
[ 1962.026807][ T7317]  __x64_sys_nanosleep+0x1dc/0x260
[ 1962.026821][ T7317]  ? hrtimer_nanosleep+0x430/0x430
[ 1962.026836][ T7317]  ? lock_is_held_type+0xb0/0xe0
[ 1962.026850][ T7317]  ? do_syscall_64+0x1c/0xe0
[ 1962.026865][ T7317]  ? lockdep_hardirqs_on_prepare+0x3a2/0x590
[ 1962.026880][ T7317]  do_syscall_64+0x60/0xe0
[ 1962.026894][ T7317]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1962.030484][ T7317] BUG: unable to handle page fault for address: 0000000040000000
[ 1962.030488][ T7317] #PF: supervisor write access in kernel mode
[ 1962.030491][ T7317] #PF: error_code(0x0002) - not-present page
[ 1962.030493][ T7317] PGD 92b73067 P4D 92b73067 PUD 0 
[ 1962.030501][ T7317] Oops: 0002 [#2] PREEMPT SMP KASAN
[ 1962.030505][ T7317] CPU: 1 PID: 7317 Comm: syz-executor.4 Not tainted 5.8.0-rc4-syzkaller #0
[ 1962.030510][ T7317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1962.030512][ T7317] RIP: 0010:in_gate_area_no_mm+0x0/0x6a
[ 1962.030522][ T7317] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1962.030525][ T7317] RSP: 0018:ffffc90007837238 EFLAGS: 00010012
[ 1962.030530][ T7317] RAX: 0000000040000000 RBX: ffffc900078372d8 RCX: ffffffff816a5e60
[ 1962.030534][ T7317] RDX: ffff88805486e280 RSI: ffffffff816a5e8b RDI: 000000000045b0b0
[ 1962.030538][ T7317] RBP: 000000000045b0b0 R08: ffffc900078373e8 R09: ffffffff8c8cc109
[ 1962.030542][ T7317] R10: 000000000045b0b0 R11: 0000000000000000 R12: ffffc900078373e8
[ 1962.030545][ T7317] R13: 0000000000000001 R14: 000000000045b0b0 R15: ffffc900078372f8
[ 1962.030550][ T7317] FS:  0000000001139940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
[ 1962.030553][ T7317] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1962.030557][ T7317] CR2: 0000000040000000 CR3: 000000004874b000 CR4: 00000000001426e0
[ 1962.030561][ T7317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1962.030565][ T7317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1962.030566][ T7317] Call Trace:
[ 1962.030569][ T7317]  kallsyms_lookup+0xc3/0x2e0
[ 1962.030571][ T7317]  __sprint_symbol+0x9c/0x1c0
[ 1962.030574][ T7317]  ? kallsyms_lookup+0x2e0/0x2e0
[ 1962.030576][ T7317]  ? kallsyms_lookup+0xff/0x2e0
[ 1962.030578][ T7317]  ? __sprint_symbol+0x12b/0x1c0
[ 1962.030581][ T7317]  symbol_string+0x14c/0x370
[ 1962.030583][ T7317]  ? set_precision+0x160/0x160
[ 1962.030586][ T7317]  ? ip6_addr_string+0x330/0x330
[ 1962.030588][ T7317]  ? symbol_string+0x297/0x370
[ 1962.030590][ T7317]  ? ip6_addr_string+0x330/0x330
[ 1962.030593][ T7317]  ? symbol_string+0x297/0x370
[ 1962.030595][ T7317]  ? check_pointer+0xb5/0x340
[ 1962.030597][ T7317]  ? ip4_addr_string_sa+0x5b0/0x5b0
[ 1962.030600][ T7317]  ? widen_string+0xd8/0x2a0
[ 1962.030602][ T7317]  ? set_precision+0x160/0x160
[ 1962.030604][ T7317]  ? number+0x7ca/0xa90
[ 1962.030606][ T7317]  pointer+0x185/0x970
[ 1962.030609][ T7317]  ? clock.constprop.0+0x20f/0x2e0
[ 1962.030611][ T7317]  ? resource_string.isra.0+0x16c0/0x16c0
[ 1962.030614][ T7317]  ? lockdep_hardirqs_on_prepare+0x590/0x590
[ 1962.030616][ T7317]  vsnprintf+0x5b2/0x14f0
[ 1962.030619][ T7317]  ? pointer+0x970/0x970
[ 1962.030621][ T7317]  ? lock_release+0x8d0/0x8d0
[ 1962.030623][ T7317]  vscnprintf+0x29/0x80
[ 1962.030625][ T7317]  vprintk_store+0x44/0x4a0
[ 1962.030627][ T7317]  vprintk_emit+0x139/0x770
[ 1962.030630][ T7317]  vprintk_func+0x8f/0x1a6
[ 1962.030631][ T7317]  printk+0xba/0xed
[ 1962.030634][ T7317]  ? log_store.cold+0x16/0x16
[ 1962.030636][ T7317]  ? unwind_next_frame+0xe3b/0x1f90
[ 1962.030638][ T7317]  show_ip+0x22/0x30
[ 1962.030641][ T7317]  show_iret_regs+0x10/0x32
[ 1962.030643][ T7317]  __show_regs+0x18/0x50
[ 1962.030645][ T7317]  ? is_bpf_text_address+0xcb/0x160
[ 1962.030648][ T7317]  show_trace_log_lvl+0x255/0x2b4
[ 1962.030651][ T7317]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1962.030653][ T7317]  die_addr.cold+0x8/0xd
[ 1962.030657][ T7317]  exc_general_protection+0x193/0x2d0
[ 1962.030661][ T7317]  asm_exc_general_protection+0x1e/0x30
[ 1962.030664][ T7317] RIP: 0010:__switch_to_asm+0x0/0x40
[ 1962.030673][ T7317] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1962.030676][ T7317] RSP: 0018:ffffc90007837bb0 EFLAGS: 00010046
[ 1962.030681][ T7317] RAX: dffffc0000000000 RBX: ffff8880ae735e18 RCX: 0000000000000000
[ 1962.030685][ T7317] RDX: 1ffff11015ce6bc2 RSI: ffff88809269e500 RDI: ffff88805486e280
[ 1962.030689][ T7317] RBP: ffffc90007837c80 R08: 0000000000000001 R09: ffff88805486eb48
[ 1962.030693][ T7317] R10: fffffbfff155cb69 R11: 0000000000000000 R12: ffff8880ae735e00
[ 1962.030696][ T7317] R13: ffff88805486e280 R14: ffff88809269e500 R15: ffff88805486e6b0
[ 1962.030699][ T7317]  __schedule+0x8e1/0x1eb0
[ 1962.030701][ T7317]  ? io_schedule_timeout+0x140/0x140
[ 1962.030704][ T7317]  ? _raw_spin_unlock_irqrestore+0x62/0xe0
[ 1962.030706][ T7317]  schedule+0xd0/0x2a0
[ 1962.030708][ T7317]  do_nanosleep+0x222/0x650
[ 1962.030710][ T7317]  ? find_held_lock+0x2d/0x110
[ 1962.030713][ T7317]  ? schedule_timeout_idle+0x80/0x80
[ 1962.030716][ T7317]  ? __free_object+0xdd0/0xdd0
[ 1962.030718][ T7317]  ? memset+0x20/0x40
[ 1962.030720][ T7317]  ? __hrtimer_init+0x12c/0x260
[ 1962.030722][ T7317]  hrtimer_nanosleep+0x1f6/0x430
[ 1962.030725][ T7317]  ? nanosleep_copyout+0x100/0x100
[ 1962.030727][ T7317]  ? _copy_from_user+0x138/0x190
[ 1962.030730][ T7317]  ? hrtimer_init_sleeper_on_stack+0x90/0x90
[ 1962.030733][ T7317]  ? put_timespec64+0x120/0x120
[ 1962.030735][ T7317]  __x64_sys_nanosleep+0x1dc/0x260
[ 1962.030738][ T7317]  ? hrtimer_nanosleep+0x430/0x430
[ 1962.030740][ T7317]  ? lock_is_held_type+0xb0/0xe0
[ 1962.030743][ T7317]  ? do_syscall_64+0x1c/0xe0
[ 1962.030745][ T7317]  ? lockdep_hardirqs_on_prepare+0x3a2/0x590
[ 1962.030748][ T7317]  do_syscall_64+0x60/0xe0
[ 1962.030751][ T7317]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1962.030755][ T7317] BUG: unable to handle page fault for address: 0000000040000000
[ 1962.030758][ T7317] #PF: supervisor write access in kernel mode
[ 1962.030761][ T7317] #PF: error_code(0x0002) - not-present page
[ 1962.030763][ T7317] PGD 92b73067 P4D 92b73067 PUD 0 
[ 1962.030770][ T7317] Oops: 0002 [#3] PREEMPT SMP KASAN
[ 1962.030774][ T7317] CPU: 1 PID: 7317 Comm: syz-executor.4 Not tainted 5.8.0-rc4-syzkaller #0
[ 1962.030779][ T7317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1962.030782][ T7317] RIP: 0010:in_gate_area_no_mm+0x0/0x6a
[ 1962.030791][ T7317] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1962.030794][ T7317] RSP: 0018:ffffc90007836720 EFLAGS: 00010012
[ 1962.030799][ T7317] RAX: 0000000040000000 RBX: ffffc900078367c0 RCX: ffffffff816a5e60
[ 1962.030803][ T7317] RDX: ffff88805486e280 RSI: ffffffff816a5e8b RDI: 000000000045b0b0
[ 1962.030807][ T7317] RBP: 000000000045b0b0 R08: ffffc900078368d0 R09: ffff8880ae723eec
[ 1962.030810][ T7317] R10: 000000000045b0b0 R11: 0000000000000001 R12: ffffc900078368d0
[ 1962.030814][ T7317] R13: 0000000000000001 R14: 000000000045b0b0 R15: ffffc900078367e0
[ 1962.030818][ T7317] FS:  0000000001139940(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
[ 1962.030822][ T7317] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1962.030826][ T7317] CR2: 0000000040000000 CR3: 000000004874b000 CR4: 00000000001426e0
[ 1962.030829][ T7317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1962.030834][ T7317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1962.030837][ T7317] Call Trace:
[ 1962.030840][ T7317]  kallsyms_lookup+0xc3/0x2e0
[ 1962.030844][ T7317]  __sprint_symbol+0x9c/0x1c0
[ 1962.030848][ T7317]  ? kallsyms_lookup+0x2e0/0x2e0
[ 1962.030852][ T7317]  ? kallsyms_lookup+0xff/0x2e0
[ 1962.030856][ T7317]  ? __sprint_symbol+0x12b/0x1c0
[ 1962.030859][ T7317]  symbol_string+0x14c/0x370
[ 1962.030861][ T7317]  ? set_precision+0x160/0x160
[ 1962.030863][ T7317]  ? ip6_addr_string+0x330/0x330
[ 1962.030866][ T7317]  ? symbol_string+0x297/0x370
[ 1962.030868][ T7317]  ? ip6_addr_string+0x330/0x330
[ 1962.030870][ T7317]  ? hex_string+0xf8/0x4c0
[ 1962.030873][ T7317]  ? set_precision+0x160/0x160
[ 1962.030875][ T7317]  ? number+0x7ca/0xa90
[ 1962.030877][ T7317]  ? widen_string+0xd8/0x2a0
[ 1962.030879][ T7317]  ? set_precision+0x160/0x160
[ 1962.030881][ T7317]  ? number+0x7ca/0xa90
[ 1962.030883][ T7317]  pointer+0x185/0x970
[ 1962.030886][ T7317]  ? clock.constprop.0+0x20f/0x2e0
[ 1962.030889][ T7317]  ? resource_string.isra.0+0x16c0/0x16c0
[ 1962.030891][ T7317]  vsnprintf+0x5b2/0x14f0
[ 1962.030893][ T7317]  ? pointer+0x970/0x970
[ 1962.030895][ T7317]  ? vsnprintf+0x2cc/0x14f0
[ 1962.030897][ T7317]  vscnprintf+0x29/0x80
[ 1962.030900][ T7317]  printk_safe_log_store+0xf5/0x250
[ 1962.030902][ T7317]  ? printk_deferred+0xf0/0xf0
[ 1962.030905][ T7317]  ? irq_work_queue+0x29/0x80
[ 1962.030907][ T7317]  ? printk_safe_log_store+0x1b7/0x250
[ 1962.030910][ T7317]  vprintk_func+0xef/0x1a6
[ 1962.030911][ T7317]  printk+0xba/0xed
[ 1962.030914][ T7317]  ? log_store.cold+0x16/0x16
[ 1962.030916][ T7317]  ? unwind_next_frame+0xe3b/0x1f90
[ 1962.030918][ T7317]  show_ip+0x22/0x30
[ 1962.030921][ T7317]  show_iret_regs+0x10/0x32
[ 1962.030923][ T7317]  __show_regs+0x18/0x50
[ 1962.030925][ T7317]  ? is_bpf_text_address+0xcb/0x160
[ 1962.030928][ T7317]  show_trace_log_lvl+0x255/0x2b4
[ 1962.030931][ T7317]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1962.030932][ T7317]  __die+0x51/0x90
[ 1962.030935][ T7317]  no_context+0x56b/0x9f0
[ 1962.030937][ T7317]  ? pgtable_bad+0x90/0x90
[ 1962.030939][ T7317]  ? mark_lock+0xbc/0x1710
[ 1962.030941][ T7317]  ? mark_lock+0xbc/0x1710
[ 1962.030943][ T7317]  ? number+0x7ca/0xa90
[ 1962.030946][ T7317]  __bad_area_nosemaphore+0xa9/0x480
[ 1962.030948][ T7317]  ? put_dec+0xd0/0xd0
[ 1962.030951][ T7317]  do_user_addr_fault+0x783/0xd00
[ 1962.030953][ T7317]  ? trace_hardirqs_off+0x27/0x210
[ 1962.030956][ T7317]  exc_page_fault+0xab/0x170
[ 1962.030958][ T7317]  asm_exc_page_fault+0x1e/0x30
[ 1962.030961][ T7317] RIP: 0010:in_gate_area_no_mm+0x0/0x6a
[ 1962.030970][ T7317] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 1962.030973][ T7317] RSP: 0018:ffffc90007837238 EFLAGS: 00010012
[ 1962.030978][ T7317] RAX: 0000000040000000 RBX: ffffc900078372d8 RCX: ffffffff816a5e60
[ 1962.030982][ T7317] RDX: ffff88805486e280 RSI: ffffffff816a5e8b RDI: 000000000045b0b0
[ 1962.030986][ T7317] RBP: 000000000045b0b0 R08: ffffc900078373e8 R09: ffffffff8c8cc109
[ 1962.030990][ T7317] R10: 000000000045b0b0 R11: 0000000000000000 R12: ffffc900078373e8
[ 1962.030994][ T7317] R13: 0000000000000001 R14: 000000000045b0b0 R15: ffffc900078372f8
[ 1962.030996][ T7317]  ? kallsyms_lookup+0x90/0x2e0
[ 1962.030998][ T7317]  ? kallsyms_lookup+0xbb/0x2e0
[ 1962.031001][ T7317]  kallsyms_lookup+0xc3/0x2e0
[ 1962.031003][ T7317]  __sprint_symbol+0x9c/0x1c0
[ 1962.031005][ T7317]  ? kallsyms_lookup+0x2e0/0x2e0
[ 1962.031008][ T7317]  ? kallsyms_lookup+0xff/0x2e0
[ 1962.031010][ T7317]  ? __sprint_symbol+0x12b/0x1c0
[ 1962.031013][ T7317]  symbol_string+0x14c/0x370
[ 1962.031015][ T7317]  ? set_precision+0x160/0x160
[ 1962.031017][ T7317]  ? ip6_addr_string+0x330/0x330
[ 1962.031020][ T7317]  ? symbol_string+0x297/0x370
[ 1962.031022][ T7317]  ? ip6_addr_string+0x330/0x330
[ 1962.031024][ T7317]  ? symbol_string+0x297/0x370
[ 1962.031027][ T7317]  ? check_pointer+0xb5/0x340
[ 1962.031029][ T7317]  ? ip4_addr_string_sa+0x5b0/0x5b0
[ 1962.031032][ T7317]  ? widen_string+0xd8/0x2a0
[ 1962.031034][ T7317]  ? set_precision+0x160/0x160
[ 1962.031036][ T7317]  ? number+0x7ca/0xa90
[ 1962.031038][ T7317]  pointer+0x185/0x970
[ 1962.031040][ T7317]  ? clock.constprop.0+0x20f/0x2e0
[ 1962.031043][ T7317]  ? resource_string.isra.0+0x16c0/0x16c0
[ 1962.031046][ T7317]  ? lockdep_hardirqs_on_prepare+0x590/0x590
[ 1962.031048][ T7317]  vsnprintf+0x5b2/0x14f0
[ 1962.031050][ T7317]  ? pointer+0x970/0x970
[ 1962.031053][ T7317]  ? lock_release+0x8d0/0x8d0
[ 1962.031055][ T7317]  vscnprintf+0x29/0x80
[ 1962.031057][ T7317]  vprintk_store+0x44/0x4a0
[ 1962.031059][ T7317]  vprintk_emit+0x139/0x770
[ 1962.031061][ T7317]  vprintk_func+0x8f/0x1a6
[ 1962.031063][ T7317]  printk+0xba/0xed
[ 1962.031066][ T7317]  ? log_store.cold+0x16/0x16
[ 1962.031068][ T7317]  ? unwind_next_frame+0xe3b/0x1f90
[ 1962.031070][ T7317]  show_ip+0x22/0x30
[ 1962.031072][ T7317]  show_iret_regs+0x10/0x32
[ 1962.031074][ T7317]  __show_regs+0x18/0x50
[ 1962.031077][ T7317]  ? is_bpf_text_address+0xcb/0x160
[ 1962.031079][ T7317]  show_trace_log_lvl+0x255/0x2b4
[ 1962.031081][ T7317]  ? entr
[ 1962.031085][ T7317] Lost 63 message(s)!