00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:47 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:47 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 3:
r0 = syz_io_uring_setup(0x0, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:47 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, 0x0, 0x0, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:47 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:47 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 3:
r0 = syz_io_uring_setup(0x73d7, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:47 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:47 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, 0x0, 0x0, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:47 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 3:
r0 = syz_io_uring_setup(0x73d7, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:47 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 3:
r0 = syz_io_uring_setup(0x73d7, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:47 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:48 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, 0x0, 0x0, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:48 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=<r1=>0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r1, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:48 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=<r1=>0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r1, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0, &(0x7f0000000100)=<r1=>0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r1, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r1, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:48 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:48 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:48 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:49 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:49 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:49 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:49 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:49 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:49 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:49 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:49 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:50 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:50 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:50 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:50 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:50 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:50 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:50 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, 0x0, 0x0, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:50 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:50 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:50 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:51 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, 0x0, 0x0, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:51 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:51 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, 0x0, 0x0, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:51 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:51 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:51 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:51 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:51 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:51 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:52 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:52 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:52 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:52 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:52 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:52 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:52 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:52 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:52 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:53 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:53 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:53 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:53 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:53 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:53 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, 0x0, 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:53 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:53 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:54 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, 0x0, 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:54 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:54 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:54 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, 0x0, 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:54 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:54 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:55 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:55 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:55 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:55 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:55 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:55 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:55 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:55 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:55 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:56 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:56 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:56 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:56 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:56 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:56 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:56 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:56 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:56 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:57 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:57 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:57 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080))
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:57 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:57 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:57 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:57 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080))
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:57 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:57 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:57 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:57 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080))
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:58 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:58 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:58 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:58 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:58 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:58 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:58 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:59 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:59 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:59 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:59 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:59 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:26:59 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:59 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:26:59 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:26:59 executing program 1:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:00 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:00 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:00 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:00 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:00 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:00 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:00 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:00 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0)
openat$sysfs(0xffffffffffffff9c, 0x0, 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:00 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:00 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:01 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 1:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 1:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:01 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 1:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:01 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:01 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:01 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:02 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:02 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:02 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:02 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:02 executing program 1:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:02 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:03 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:03 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:03 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:03 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:03 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:03 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:03 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(0x0, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:03 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:04 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x1, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

00:27:04 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x10, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 1:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 1:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:04 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 1:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:04 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r2 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r3=>0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:05 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:05 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 0:
r0 = syz_io_uring_setup(0x0, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 5:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r0 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r1=>0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 5:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r0 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r1=>0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 0:
r0 = syz_io_uring_setup(0x0, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:05 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:05 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 5:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r0 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r1=>0x0)
syz_io_uring_submit(0x0, r1, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)

00:27:06 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = socket$packet(0x11, 0x0, 0x300)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = dup(r2)
r4 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000080)={0x0, r3})

00:27:06 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = dup(r2)
r4 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000080)={0x0, r3})

00:27:06 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)

00:27:06 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = dup(r2)
r4 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000080)={0x0, r3})

00:27:06 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:06 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = dup(r2)
r4 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000080)={0x0, r3})

00:27:07 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000))
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:07 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000))
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:07 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x11, 0x0, 0x0)

00:27:07 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
socket$packet(0x11, 0x3, 0x300)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = dup(r1)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000080)={0x0, r2})

00:27:07 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000))
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:07 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
socket$packet(0x11, 0x3, 0x300)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = dup(r1)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000080)={0x0, r2})

00:27:07 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000140)="656436f30f09d2f7baf80c66b8aca9ca8d66efbafc0cb8a500ef0fc77481ba400066ed0f71e400260f01cf26f30fc7b3ed10660fc7360000643e640f01c4", 0x3e}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000))
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001d000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000200)="48b800a00000000000000f23c80f21f8350c0080000f23f848b800000000000000000f23c00f21f835010001000f23f8420f01df66bad10466edc441cde94f4bc4629d8c2ef3410fc7b64c00000066b83b000f00d8c462fd31d345f4", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:07 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:07 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
socket$packet(0x11, 0x3, 0x300)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = dup(r1)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000080)={0x0, r2})

00:27:07 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = socket$packet(0x11, 0x3, 0x300)
socket$netlink(0x10, 0x3, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:07 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:07 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:07 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:07 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:08 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, 0x0, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:08 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:08 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f00000007c0)=ANY=[])
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:08 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:08 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:08 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:08 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:08 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:09 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:09 executing program 0:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, 0xffffffffffffffff, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:09 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 0:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
r1 = eventfd(0x0)
ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af21, &(0x7f0000000040)={0x0, r1})

00:27:09 executing program 5:
ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:09 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(0x0, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:09 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:09 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)="4db1ad43602f235c", 0x0, 0x8})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:09 executing program 5:
ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:09 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, 0x0, &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 5:
ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:09 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:09 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:09 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:09 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:09 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:09 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:10 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}]})
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:10 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:10 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:10 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:10 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:10 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:10 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(0x0, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:10 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)="4db1ad43602f235ca6f2", 0x0, 0xa})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:10 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:10 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:10 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:10 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)="4db1ad43602f235ca6f2", 0x0, 0xa})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:10 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:10 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:10 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:11 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:11 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)="4db1ad43602f235ca6f2", 0x0, 0xa})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:11 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, 0x0, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:11 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x0, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:11 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x0, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:11 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:11 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x0, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:11 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:11 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, 0x0, &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:11 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:11 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, 0x0, &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, 0x0, &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:11 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:11 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:12 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, 0x0, &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:12 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, 0x0, &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0, &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080))

00:27:12 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:12 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:12 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, 0x0, &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
socket$packet(0x11, 0x3, 0x300)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:12 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0, &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0, &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:12 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
socket$packet(0x11, 0x3, 0x300)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:12 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0, &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0, &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:12 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
socket$packet(0x11, 0x3, 0x300)
r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff)
ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000080))

00:27:12 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0, &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:12 executing program 2:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0, &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:12 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000080))

00:27:12 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:12 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000080))

00:27:13 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:13 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:13 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000080))

00:27:13 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(0x0, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(0x0, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:13 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:13 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0)

00:27:13 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:13 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(0x0, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(0x0, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0)

00:27:13 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:13 executing program 5:
r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$int_in(r0, 0x40000000af01, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0)

00:27:13 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(0x0, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(0x0, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(0x0, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:13 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:13 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:14 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:14 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:14 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)

00:27:14 executing program 1:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r0, 0xae80, 0x0)

00:27:14 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780))
syz_io_uring_submit(r1, 0x0, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 1:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r0, 0xae80, 0x0)

00:27:14 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:14 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)

00:27:14 executing program 1:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r0, 0xae80, 0x0)

00:27:14 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:14 executing program 1:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

00:27:14 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:14 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)

00:27:14 executing program 1:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

00:27:15 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, 0x0, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000500)="57a6", 0x2}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0x8090ae81, 0x0)

00:27:15 executing program 1:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

00:27:15 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:15 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:15 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:15 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:15 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:15 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, 0x0, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:15 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(0xffffffffffffffff, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 1:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

00:27:15 executing program 5:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780))
io_uring_enter(r0, 0x2bc3, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:15 executing program 4:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000580)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0x8090ae81, 0x0)

00:27:15 executing program 1:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

00:27:15 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:15 executing program 5:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, r3})

00:27:16 executing program 1:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

00:27:16 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:16 executing program 4:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, r3})

00:27:16 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:16 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:16 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0x8090ae81, 0x0)

00:27:16 executing program 3:
r0 = syz_io_uring_setup(0x73d7, &(0x7f0000000480), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000380)=<r1=>0x0, &(0x7f0000000100)=<r2=>0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000008540)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)='x', 0x1}, 0x10001)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x6, 0x11, r0, 0x10000000)
syz_io_uring_submit(r1, r2, &(0x7f0000000280)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd_index}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000700)=@IORING_OP_POLL_REMOVE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000a40)=@IORING_OP_WRITE_FIXED, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000340)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_CLOSE, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x3edc, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000300000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=<r4=>0x0)
syz_io_uring_submit(r1, r4, &(0x7f0000000440)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_io_uring_setup(0x2a2c, &(0x7f0000000080), &(0x7f0000300000/0x2000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000), &(0x7f0000000780)=<r5=>0x0)
syz_io_uring_submit(r1, r5, &(0x7f0000000400)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index}, 0x0)
io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:27:16 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0x8090ae81, 0x0)

00:27:16 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:16 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0x8090ae81, 0x0)

00:27:16 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:17 executing program 5:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, r3})

00:27:17 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:17 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r0, 0xae80, 0x0)
ioctl$KVM_RUN(r0, 0xae80, 0x0)
ioctl$KVM_RUN(r0, 0x8090ae81, 0x0)

00:27:17 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:17 executing program 3:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf000000})

00:27:17 executing program 4:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf000000})

00:27:17 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r0, 0xae80, 0x0)
ioctl$KVM_RUN(r0, 0xae80, 0x0)
ioctl$KVM_RUN(r0, 0x8090ae81, 0x0)

00:27:17 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r0, 0xae80, 0x0)
ioctl$KVM_RUN(r0, 0xae80, 0x0)
ioctl$KVM_RUN(r0, 0x8090ae81, 0x0)

00:27:17 executing program 0:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0x8090ae81, 0x0)

00:27:17 executing program 0:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0x8090ae81, 0x0)

00:27:17 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:17 executing program 0:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0x8090ae81, 0x0)

00:27:18 executing program 5:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, r3})

00:27:18 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:18 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:18 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:18 executing program 3:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf000000})

00:27:18 executing program 4:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf000000})

00:27:18 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:18 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:18 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0x8090ae81, 0x0)

00:27:18 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:19 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:19 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0x8090ae81, 0x0)

00:27:19 executing program 5:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, 0x0)

00:27:19 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:19 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_RUN(r1, 0x8090ae81, 0x0)

00:27:19 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:19 executing program 3:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf000000})

00:27:19 executing program 4:
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
fallocate(r3, 0x0, 0x0, 0x2000402)
fallocate(r2, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000040)={0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf000000})

00:27:19 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

00:27:20 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f0000000200), 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:20 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/module/firewire_sbp2', 0x5ab201, 0x0)
syz_io_uring_complete(0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

00:27:20 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000007c0)=[{0x0}], 0x1, &(0x7f0000000840)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01, 0xee00}}}], 0x40}, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0x8090ae81, 0x0)

[  909.393489][T24044] ------------[ cut here ]------------