0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:37 executing program 1:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, &(0x7f0000000140))

[  714.317472][T14128] 8021q: adding VLAN 0 to HW filter on device bond0
17:40:37 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:37 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  714.394469][T14128] 8021q: adding VLAN 0 to HW filter on device team0
[  714.403298][ T1280] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  714.411216][ T1280] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
17:40:38 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  714.479989][ T1280] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  714.503194][ T1280] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  714.511696][ T1280] bridge0: port 1(bridge_slave_0) entered blocking state
[  714.518822][ T1280] bridge0: port 1(bridge_slave_0) entered forwarding state
[  714.576258][ T1280] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  714.593091][ T1280] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  714.613321][ T1280] bridge0: port 2(bridge_slave_1) entered blocking state
[  714.620455][ T1280] bridge0: port 2(bridge_slave_1) entered forwarding state
[  714.688343][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  714.696884][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
17:40:38 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:38 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  714.733533][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
17:40:38 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  714.775129][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
17:40:38 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:38 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

[  714.820164][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  714.853497][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
17:40:38 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  714.883754][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  714.896563][T14185] 8021q: adding VLAN 0 to HW filter on device bond0
17:40:38 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

[  714.927160][T14128] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  714.953310][T14128] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
17:40:38 executing program 1:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))

[  714.996190][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  715.004994][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
17:40:38 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:38 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  715.041793][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  715.063264][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  715.078340][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
17:40:38 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:38 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  715.117314][ T6048] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  715.129508][ T6048] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  715.173345][ T6048] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
17:40:38 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:38 executing program 1:
open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300), 0x4)
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x101, '\x00', 0x0, r0, 0x2, 0x4}, 0x48)

17:40:38 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  715.226025][T14185] 8021q: adding VLAN 0 to HW filter on device team0
17:40:38 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  715.366444][ T1280] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  715.389237][ T1280] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
17:40:38 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  715.410294][ T1280] bridge0: port 1(bridge_slave_0) entered blocking state
[  715.417444][ T1280] bridge0: port 1(bridge_slave_0) entered forwarding state
17:40:39 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:39 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:39 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  715.588913][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  715.603089][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  715.618750][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  715.662870][ T3563] bridge0: port 2(bridge_slave_1) entered blocking state
[  715.669958][ T3563] bridge0: port 2(bridge_slave_1) entered forwarding state
[  715.701359][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  715.729061][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
17:40:39 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:39 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  715.803578][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  715.824239][ T3574] Bluetooth: hci4: command 0x0419 tx timeout
[  715.827098][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
17:40:39 executing program 3:
open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x101, '\x00', 0x0, r0, 0x2, 0x4}, 0x48)

[  715.863220][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  715.902786][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
17:40:39 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:39 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  715.911497][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  715.953074][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  715.981601][T14185] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
17:40:39 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:39 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  716.022947][T14185] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
17:40:39 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  716.075323][T14128] 8021q: adding VLAN 0 to HW filter on device batadv0
[  716.138730][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  716.154028][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  716.161597][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
17:40:39 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:39 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:39 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)

[  716.192353][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  716.222865][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  716.356209][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  716.378199][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
17:40:40 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:40 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:40 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  716.494796][  T144] device hsr_slave_0 left promiscuous mode
17:40:40 executing program 1:
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000080))

[  716.535324][  T144] device hsr_slave_1 left promiscuous mode
[  716.546013][  T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  716.587445][  T144] batman_adv: batadv0: Removing interface: batadv_slave_0
17:40:40 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:40 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  716.627959][  T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  716.659985][  T144] batman_adv: batadv0: Removing interface: batadv_slave_1
17:40:40 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  716.699959][  T144] device bridge_slave_1 left promiscuous mode
[  716.725849][  T144] bridge0: port 2(bridge_slave_1) entered disabled state
17:40:40 executing program 1:
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  716.766674][  T144] device bridge_slave_0 left promiscuous mode
[  716.780273][  T144] bridge0: port 1(bridge_slave_0) entered disabled state
17:40:40 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:40 executing program 3:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0)

17:40:40 executing program 1:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0)

[  716.856994][  T144] device hsr_slave_0 left promiscuous mode
[  716.882970][  T144] device hsr_slave_1 left promiscuous mode
17:40:40 executing program 0:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

17:40:40 executing program 3:
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:40 executing program 1:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0)

[  716.950774][  T144] batman_adv: batadv0: Removing interface: batadv_slave_0
[  716.961444][  T144] batman_adv: batadv0: Removing interface: batadv_slave_1
[  716.985626][  T144] device bridge_slave_1 left promiscuous mode
17:40:40 executing program 0:
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0)

[  717.015917][  T144] bridge0: port 2(bridge_slave_1) entered disabled state
17:40:40 executing program 1:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

17:40:40 executing program 0:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0)

[  717.096517][  T144] device bridge_slave_0 left promiscuous mode
[  717.116288][  T144] bridge0: port 1(bridge_slave_0) entered disabled state
17:40:40 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:40 executing program 1:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

17:40:40 executing program 0:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

[  717.178960][  T144] device hsr_slave_0 left promiscuous mode
[  717.208406][  T144] device hsr_slave_1 left promiscuous mode
17:40:40 executing program 1:
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0)

[  717.283731][  T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  717.291212][  T144] batman_adv: batadv0: Removing interface: batadv_slave_0
17:40:40 executing program 0:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

[  717.404665][  T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  717.412142][  T144] batman_adv: batadv0: Removing interface: batadv_slave_1
17:40:41 executing program 1:
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x0, 0x0)

17:40:41 executing program 3:
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0)

17:40:41 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  717.468375][  T144] device bridge_slave_1 left promiscuous mode
[  717.483537][  T144] bridge0: port 2(bridge_slave_1) entered disabled state
17:40:41 executing program 1:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

[  717.570241][  T144] device bridge_slave_0 left promiscuous mode
[  717.582397][  T144] bridge0: port 1(bridge_slave_0) entered disabled state
17:40:41 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  717.645357][  T144] device hsr_slave_0 left promiscuous mode
[  717.661742][  T144] device hsr_slave_1 left promiscuous mode
[  717.669399][  T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  717.678285][  T144] batman_adv: batadv0: Removing interface: batadv_slave_0
17:40:41 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:41 executing program 1:
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0)

[  717.743578][  T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  717.751054][  T144] batman_adv: batadv0: Removing interface: batadv_slave_1
17:40:41 executing program 0:
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x0, 0x0)

[  717.792512][  T144] device bridge_slave_1 left promiscuous mode
[  717.815250][  T144] bridge0: port 2(bridge_slave_1) entered disabled state
17:40:41 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:41 executing program 0:
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0)

[  717.845863][  T144] device bridge_slave_0 left promiscuous mode
[  717.852112][  T144] bridge0: port 1(bridge_slave_0) entered disabled state
17:40:41 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  717.917350][  T144] device hsr_slave_0 left promiscuous mode
[  717.943032][  T144] device hsr_slave_1 left promiscuous mode
[  717.950396][  T144] batman_adv: batadv0: Removing interface: batadv_slave_0
17:40:41 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:41 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  717.978218][  T144] batman_adv: batadv0: Removing interface: batadv_slave_1
[  717.994992][  T144] device bridge_slave_1 left promiscuous mode
[  718.006004][  T144] bridge0: port 2(bridge_slave_1) entered disabled state
17:40:41 executing program 0:
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0)

17:40:41 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

[  718.045813][  T144] device bridge_slave_0 left promiscuous mode
[  718.056822][  T144] bridge0: port 1(bridge_slave_0) entered disabled state
17:40:41 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:41 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:41 executing program 1:
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0)

[  718.135223][  T144] device veth1_macvtap left promiscuous mode
[  718.141316][  T144] device veth0_macvtap left promiscuous mode
17:40:41 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  718.182320][  T144] device veth1_vlan left promiscuous mode
[  718.188250][  T144] device veth0_vlan left promiscuous mode
17:40:41 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, &(0x7f0000000140))

[  718.240025][  T144] device veth0_vlan left promiscuous mode
[  718.256080][  T144] device veth1_macvtap left promiscuous mode
[  718.283586][  T144] device veth0_macvtap left promiscuous mode
[  718.300246][  T144] device veth1_vlan left promiscuous mode
[  718.311521][  T144] device veth0_vlan left promiscuous mode
17:40:41 executing program 3:
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0)

17:40:41 executing program 1:
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x48)

17:40:41 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, &(0x7f0000000140))

[  718.335916][  T144] device veth1_macvtap left promiscuous mode
17:40:41 executing program 1:
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x48)

[  718.392560][  T144] device veth0_macvtap left promiscuous mode
[  718.398692][  T144] device veth1_vlan left promiscuous mode
17:40:42 executing program 0:
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x48)

17:40:42 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, &(0x7f0000000140))

[  718.438135][  T144] device veth0_vlan left promiscuous mode
[  718.450343][  T144] device veth1_vlan left promiscuous mode
[  718.462495][  T144] device veth0_vlan left promiscuous mode
17:40:42 executing program 0:
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x48)

17:40:42 executing program 3:
r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x48)

17:40:42 executing program 1:
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0)

17:40:42 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:42 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:40:42 executing program 0:
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0)

17:40:42 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:42 executing program 1:
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900), 0x48)

17:40:42 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:40:42 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:42 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:42 executing program 0:
bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0)

17:40:42 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
gettid()

17:40:42 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:42 executing program 3:
bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0)

17:40:42 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:40:42 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:40:42 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:42 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:42 executing program 0:
bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0)

17:40:42 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)

17:40:42 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, &(0x7f0000000140))

17:40:42 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)

17:40:42 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:40:42 executing program 3:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, &(0x7f0000000140))

17:40:42 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:42 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:40:42 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:40:42 executing program 1:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, &(0x7f0000000140))

17:40:42 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:42 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
pipe2$9p(&(0x7f0000000640)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x4080)
write$P9_RLOCK(r4, &(0x7f0000000840)={0x8, 0x35, 0x2, 0x1}, 0x8)

17:40:43 executing program 0:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, &(0x7f0000000140))

17:40:43 executing program 3:
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x0, &(0x7f0000000140))

17:40:43 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 0:
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x0, &(0x7f0000000140))

17:40:43 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:43 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:43 executing program 0:
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x0, &(0x7f0000000140))

17:40:43 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:43 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:43 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:43 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:43 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:43 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:43 executing program 1:
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, 0x0)

17:40:43 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, &(0x7f0000000140))

17:40:43 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:43 executing program 0:
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, 0x0)

17:40:43 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:43 executing program 0:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x0, &(0x7f0000000140))

17:40:43 executing program 1:
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, 0x0)

17:40:43 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:43 executing program 1:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x0, &(0x7f0000000140))

17:40:43 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:43 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
syz_pidfd_open(0x0, 0x0)

17:40:43 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:40:43 executing program 3:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x0, &(0x7f0000000140))

17:40:43 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:43 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, 0x0)

17:40:43 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:44 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:44 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:44 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x80044d05, 0x0)

17:40:44 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
syz_pidfd_open(0x0, 0x0)

17:40:44 executing program 1:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, 0x0)

17:40:44 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
r5 = gettid()
syz_pidfd_open(r5, 0x0)

17:40:44 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
r5 = gettid()
syz_pidfd_open(r5, 0x0)

17:40:44 executing program 0:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, 0x0)

17:40:44 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
syz_pidfd_open(0x0, 0x0)

17:40:44 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
open_tree(0xffffffffffffffff, &(0x7f0000000700)='./file0/file0\x00', 0x0)

17:40:44 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  720.743868][  T144] team0 (unregistering): Port device team_slave_1 removed
17:40:44 executing program 1:
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, 0x0)

17:40:44 executing program 3:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
open_tree(0xffffffffffffffff, &(0x7f0000000700)='./file0/file0\x00', 0x0)

[  720.816819][  T144] team0 (unregistering): Port device team_slave_0 removed
17:40:44 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:44 executing program 0:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, 0x0)

[  720.900226][  T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
17:40:44 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:44 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
r2 = gettid()
syz_pidfd_open(r2, 0x0)

[  720.958816][  T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
17:40:44 executing program 1:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, 0x0)

17:40:44 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:44 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:44 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
syz_pidfd_open(0x0, 0x0)

17:40:44 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(0xffffffffffffffff, 0x80044dfd, &(0x7f00000008c0))

17:40:44 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r0, 0x0, 0x0)

17:40:44 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:44 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
syz_pidfd_open(0x0, 0x0)

17:40:44 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:44 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:44 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
syz_pidfd_open(0x0, 0x0)

[  721.290342][  T144] bond0 (unregistering): Released all slaves
17:40:44 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r5, 0x80044dfd, &(0x7f00000008c0))

17:40:44 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r3, 0x80044dfd, &(0x7f00000008c0))

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:45 executing program 3:
syz_pidfd_open(0x0, 0x0)

17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r3, 0x80044dfd, &(0x7f00000008c0))

17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)

[  721.845051][  T144] team0 (unregistering): Port device team_slave_1 removed
17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)

[  721.909155][  T144] team0 (unregistering): Port device team_slave_0 removed
17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)

[  721.970745][  T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  722.050207][  T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r6, 0x80044dfd, &(0x7f00000008c0))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r1, 0x80044dfd, &(0x7f00000008c0))

17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
gettid()
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)

[  722.343146][  T144] bond0 (unregistering): Released all slaves
17:40:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:45 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)

17:40:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)

17:40:46 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:46 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:46 executing program 0:
openat$pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

17:40:46 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)

17:40:46 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:46 executing program 1:
openat$pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

17:40:46 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:46 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:46 executing program 3:
openat$pidfd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

17:40:46 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r6, 0x80044dfd, &(0x7f00000008c0))
open_tree(r2, &(0x7f0000000e40)='./file0\x00', 0x801)

17:40:46 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r6, 0x80044dfd, &(0x7f00000008c0))
open_tree(r2, &(0x7f0000000e40)='./file0\x00', 0x801)

17:40:46 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  722.788885][  T144] team0 (unregistering): Port device team_slave_1 removed
[  722.856882][  T144] team0 (unregistering): Port device team_slave_0 removed
17:40:46 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
open_tree(r2, &(0x7f0000000e40)='./file0\x00', 0x801)

17:40:46 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:46 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
open_tree(r2, &(0x7f0000000e40)='./file0\x00', 0x801)

[  722.908080][  T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
17:40:46 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:46 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  722.995616][  T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
17:40:46 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
open_tree(r2, &(0x7f0000000e40)='./file0\x00', 0x801)

17:40:46 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
open_tree(r2, &(0x7f0000000e40)='./file0\x00', 0x801)

17:40:46 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:46 executing program 0:
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000900)=0x1)

17:40:46 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:46 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:46 executing program 1:
syz_clone(0x0, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:46 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  723.307859][  T144] bond0 (unregistering): Released all slaves
17:40:46 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:47 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:47 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:47 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:47 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:47 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
gettid()

17:40:47 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:47 executing program 1:
syz_clone(0x20000000, &(0x7f0000000040), 0x0, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

[  723.853112][  T144] team0 (unregistering): Port device team_slave_1 removed
17:40:47 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  723.935396][  T144] team0 (unregistering): Port device team_slave_0 removed
17:40:47 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
gettid()

[  724.047832][  T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  724.070129][  T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
17:40:47 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
gettid()

17:40:47 executing program 3:
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3", 0xba, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:47 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:47 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
gettid()

17:40:48 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:48 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
gettid()

[  724.610938][  T144] bond0 (unregistering): Released all slaves
17:40:48 executing program 0:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:48 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:48 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:48 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})

17:40:48 executing program 3:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:48 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:48 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={0x0, 0x401})

17:40:48 executing program 3:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x0, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:49 executing program 0:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:49 executing program 1:
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:40:49 executing program 3:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x0, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:49 executing program 0:
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:49 executing program 1:
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

[  725.868108][  T144] team0 (unregistering): Port device team_slave_1 removed
[  725.979134][  T144] team0 (unregistering): Port device team_slave_0 removed
17:40:49 executing program 3:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

[  726.027057][  T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
17:40:49 executing program 0:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, 0x0, 0x0, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:49 executing program 1:
r0 = syz_open_dev$dri(0x0, 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={0x0, 0x401})

17:40:49 executing program 3:
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:50 executing program 1:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

[  726.523826][  T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
17:40:50 executing program 0:
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, 0x0, &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:50 executing program 1:
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:50 executing program 3:
openat$thread_pidfd(0xffffffffffffff9c, 0x0, 0x48880, 0x0)

17:40:50 executing program 0:
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:50 executing program 1:
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), 0x0, &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:50 executing program 3:
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), 0x0)

17:40:51 executing program 1:
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x0, 0x0)

17:40:51 executing program 3:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3", 0xba, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:51 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

[  727.697503][  T144] bond0 (unregistering): Released all slaves
17:40:51 executing program 1:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:51 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:51 executing program 0:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000300))

[  728.451853][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  728.482840][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  728.503617][T14128] device veth0_vlan entered promiscuous mode
[  728.522753][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  728.530576][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  728.586578][T14128] device veth1_vlan entered promiscuous mode
[  728.655113][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  728.667471][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  728.684144][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  728.691625][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
17:40:52 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

[  728.721136][T14128] device veth0_macvtap entered promiscuous mode
[  728.748976][T14185] 8021q: adding VLAN 0 to HW filter on device batadv0
[  728.763656][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
17:40:52 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

[  728.772524][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  728.783157][T14128] device veth1_macvtap entered promiscuous mode
[  728.808976][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  728.818149][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  728.848046][T14128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  728.902279][T14128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  728.933749][T14128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  728.945510][T14128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  728.972343][T14128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
17:40:52 executing program 3:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

[  729.002333][T14128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  729.039078][T14128] batman_adv: batadv0: Interface activated: batadv_slave_0
[  729.051131][ T3646] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  729.060920][ T3646] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  729.109286][T14128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  729.152554][T14128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  729.175391][T14128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  729.202433][T14128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  729.224217][T14128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  729.245976][T14128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  729.273664][T14128] batman_adv: batadv0: Interface activated: batadv_slave_1
[  729.282398][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  729.291166][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  729.334306][T14128] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  729.372501][T14128] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  729.381254][T14128] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  729.428135][T14128] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  729.468571][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  729.493334][ T3563] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
17:40:53 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:53 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:53 executing program 1:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

[  730.248266][T14185] device veth0_vlan entered promiscuous mode
[  730.282691][   T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  730.303009][   T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
17:40:53 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

[  730.471889][T14185] device veth1_vlan entered promiscuous mode
[  730.523772][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  730.532826][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  730.552880][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  730.612844][   T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  730.621422][   T13] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  730.648160][T14185] device veth0_macvtap entered promiscuous mode
[  730.669379][T10539] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  730.692759][T10539] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
17:40:54 executing program 3:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

[  730.720605][T14185] device veth1_macvtap entered promiscuous mode
17:40:54 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

[  730.763287][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  730.772746][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  730.792956][ T3566] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  730.814244][T10539] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  730.831011][T14185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  730.845438][T14185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  730.858521][T14185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  730.864998][T10539] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  730.870942][T14185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  730.913197][T14185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  730.932877][T14185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  730.954874][T14185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  730.982301][T14185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  731.014381][T14185] batman_adv: batadv0: Interface activated: batadv_slave_0
[  731.022976][   T21] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  731.034411][   T21] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  731.067504][   T21] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
17:40:54 executing program 2:
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

[  731.108412][T14185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
17:40:54 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:54 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

[  731.202425][T14185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  731.222266][T14185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  731.242293][T14185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  731.284100][T14185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  731.324641][T14185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  731.346585][T14185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  731.382236][T14185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  731.405000][T14185] batman_adv: batadv0: Interface activated: batadv_slave_1
[  731.439936][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  731.449800][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  731.475409][T14185] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  731.499807][T14185] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  731.528919][T14185] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
17:40:55 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

[  731.553081][T14185] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
17:40:55 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:55 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:55 executing program 1:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9", 0xe8, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:55 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
ioctl$PPPIOCGIDLE64(0xffffffffffffffff, 0x8010743f, &(0x7f00000003c0))

17:40:55 executing program 2:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:56 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
ioctl$PPPIOCGIDLE64(0xffffffffffffffff, 0x8010743f, &(0x7f00000003c0))

17:40:56 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:56 executing program 1:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:56 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:56 executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e", 0xf4, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

[  733.377566][ T3892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  733.424506][ T3892] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  733.432676][T10539] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  733.440644][T10539] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  733.448865][ T1066] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
17:40:57 executing program 4:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)

[  733.527018][ T3573] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
17:40:57 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)

17:40:57 executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e", 0xf4, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:57 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4, <r8=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r8})

17:40:57 executing program 1:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {0xee01}, 0x7, 0x4})
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r0, 0x8010743f, &(0x7f00000003c0))

17:40:57 executing program 4:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:58 executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e6402", 0xf6, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:58 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f0000000480)={r3, 0x6})

17:40:58 executing program 0:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:58 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r4, 0x8010743f, &(0x7f00000003c0))
r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r6, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500))

17:40:58 executing program 1:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), 0x0, &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:40:58 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:40:59 executing program 2:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0))

17:40:59 executing program 4:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0))

17:40:59 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r4, 0x8010743f, &(0x7f00000003c0))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
getgid()

17:40:59 executing program 4:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:41:00 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)

17:41:00 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4})
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)

17:41:00 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
getgid()

17:41:00 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r4, 0x8010743f, &(0x7f00000003c0))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)

17:41:00 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
write$P9_RSTATu(r6, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, 0x0, r2}}, 0x77)

17:41:00 executing program 0:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:41:01 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:01 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:02 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
write$P9_RSTATu(r6, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, 0x0, r2}}, 0x77)

17:41:02 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:02 executing program 4:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0)

17:41:02 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:02 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, 0x0, r2}}, 0x77)

17:41:03 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
write$P9_RSTATu(r5, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, 0x0, r2}}, 0x77)

17:41:03 executing program 1:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0)

17:41:03 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)

17:41:04 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4, <r8=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r8})
openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)

17:41:04 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:04 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4, <r8=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r8})
openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)

17:41:05 executing program 1:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r0=>0xee01}, 0x7, 0x4})
r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
write$P9_RSTATu(r1, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', 0x0, 0x0, r0}}, 0x77)

17:41:05 executing program 2:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0)

17:41:05 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, 0x0, 0x1, 0x3}, 0x10)

17:41:05 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4, <r8=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r8})
getgid()
connect$nfc_raw(r6, &(0x7f0000000640)={0x27, 0x0, 0x1, 0x3}, 0x10)

17:41:05 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4, <r8=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r8})
connect$nfc_raw(r6, &(0x7f0000000640)={0x27, 0x0, 0x1, 0x3}, 0x10)

17:41:05 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r4, 0x8010743f, &(0x7f00000003c0))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)

17:41:06 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r4, 0x8010743f, &(0x7f00000003c0))
r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r6, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f0000000480)={r3, 0x6})
connect$nfc_raw(r5, &(0x7f0000000640)={0x27, 0x0, 0x1, 0x3}, 0x10)

17:41:06 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
connect$nfc_raw(r4, &(0x7f0000000640)={0x27, 0x0, 0x1, 0x3}, 0x10)

17:41:06 executing program 0:
syz_open_dev$dri(0x0, 0x0, 0x0)
syz_clone(0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000001c0))

17:41:07 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)

17:41:08 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4, <r8=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r8})
write$ppp(0xffffffffffffffff, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)

17:41:08 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r4, 0x8010743f, &(0x7f00000003c0))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r5, 0x3302)
write$ppp(0xffffffffffffffff, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)

17:41:08 executing program 0:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r0, 0x0, 0x0)

17:41:08 executing program 3:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r0, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x800, 0x6, '9P2000'}, 0x13)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x20, 0x2, 0x8}, 0xff}}, 0x18)
write$P9_RWRITE(r0, &(0x7f0000000100)={0xb, 0x77, 0x2, 0x2}, 0xb)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x1}, 0x7)
write$P9_RLOPEN(r0, &(0x7f0000000180)={0x18, 0xd, 0x2, {{0x10, 0x0, 0x4}, 0x111}}, 0x18)
write$P9_RXATTRCREATE(r0, &(0x7f00000001c0)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREAD(r0, &(0x7f0000000200)={0x9f, 0x75, 0x2, {0x94, "e7f61f5a0d599e69984dc08c5cc187eeafc7e0557e9b34b8616e94aa867edd2c9c03c6369bf3231584a49c8b997fd8d051c1ae8b6ccddee85d776bd08cd8e6bffd4fee0834aceed9d7db30c21ebdcd8e3cd87820b8924f8995a27f3082a6cc9505994a03868704a546e5a9be76edaa9596ec2df2abb33eb088fce770774b1e81084b02d9645235f5e373656c0efcbd3fe2fc0997"}}, 0x9f)
write$P9_RWRITE(r0, &(0x7f00000002c0)={0xb, 0x77, 0x2, 0xb7c}, 0xb)
pipe2$9p(&(0x7f0000000300)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = getpgid(0x0)
write$P9_RGETLOCK(r1, &(0x7f0000000340)={0x24, 0x37, 0x1, {0x2, 0xfffffffffffffff7, 0x7, r2, 0x6, '9P2000'}}, 0x24)
r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000380), 0x400000, 0x0)
ioctl$mixer_OSS_ALSAEMULVER(r3, 0x80044df9, &(0x7f00000003c0))
write$P9_RLINK(r1, &(0x7f0000000400)={0x7, 0x47, 0x2}, 0x7)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000740), 0x44840, 0x0)

17:41:08 executing program 4:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r0, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x800, 0x6, '9P2000'}, 0x13)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x20, 0x2, 0x8}, 0xff}}, 0x18)
write$P9_RWRITE(r0, &(0x7f0000000100)={0xb, 0x77, 0x2, 0x2}, 0xb)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x1}, 0x7)
write$P9_RLOPEN(r0, &(0x7f0000000180)={0x18, 0xd, 0x2, {{0x10, 0x0, 0x4}, 0x111}}, 0x18)
write$P9_RXATTRCREATE(r0, &(0x7f00000001c0)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREAD(r0, &(0x7f0000000200)={0x9f, 0x75, 0x2, {0x94, "e7f61f5a0d599e69984dc08c5cc187eeafc7e0557e9b34b8616e94aa867edd2c9c03c6369bf3231584a49c8b997fd8d051c1ae8b6ccddee85d776bd08cd8e6bffd4fee0834aceed9d7db30c21ebdcd8e3cd87820b8924f8995a27f3082a6cc9505994a03868704a546e5a9be76edaa9596ec2df2abb33eb088fce770774b1e81084b02d9645235f5e373656c0efcbd3fe2fc0997"}}, 0x9f)
write$P9_RWRITE(r0, &(0x7f00000002c0)={0xb, 0x77, 0x2, 0xb7c}, 0xb)
pipe2$9p(&(0x7f0000000300)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = getpgid(0x0)
write$P9_RGETLOCK(r1, &(0x7f0000000340)={0x24, 0x37, 0x1, {0x2, 0xfffffffffffffff7, 0x7, r2, 0x6, '9P2000'}}, 0x24)
r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000380), 0x400000, 0x0)
ioctl$mixer_OSS_ALSAEMULVER(r3, 0x80044df9, &(0x7f00000003c0))
openat$mixer(0xffffffffffffff9c, &(0x7f0000000740), 0x44840, 0x0)

17:41:08 executing program 1:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
write$ppp(0xffffffffffffffff, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)

17:41:09 executing program 4:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4, <r8=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r8})
write$ppp(0xffffffffffffffff, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)

17:41:09 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r0, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x800, 0x6, '9P2000'}, 0x13)
write$P9_RREMOVE(r0, &(0x7f0000000080)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x20, 0x2, 0x8}, 0xff}}, 0x18)
write$P9_RWRITE(r0, &(0x7f0000000100)={0xb, 0x77, 0x2, 0x2}, 0xb)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x1}, 0x7)
write$P9_RLOPEN(r0, &(0x7f0000000180)={0x18, 0xd, 0x2, {{0x10, 0x0, 0x4}, 0x111}}, 0x18)
write$P9_RXATTRCREATE(r0, &(0x7f00000001c0)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREAD(r0, &(0x7f0000000200)={0x9f, 0x75, 0x2, {0x94, "e7f61f5a0d599e69984dc08c5cc187eeafc7e0557e9b34b8616e94aa867edd2c9c03c6369bf3231584a49c8b997fd8d051c1ae8b6ccddee85d776bd08cd8e6bffd4fee0834aceed9d7db30c21ebdcd8e3cd87820b8924f8995a27f3082a6cc9505994a03868704a546e5a9be76edaa9596ec2df2abb33eb088fce770774b1e81084b02d9645235f5e373656c0efcbd3fe2fc0997"}}, 0x9f)
write$P9_RWRITE(r0, &(0x7f00000002c0)={0xb, 0x77, 0x2, 0xb7c}, 0xb)
pipe2$9p(&(0x7f0000000300)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = getpgid(0x0)
write$P9_RGETLOCK(r1, &(0x7f0000000340)={0x24, 0x37, 0x1, {0x2, 0xfffffffffffffff7, 0x7, r2, 0x6, '9P2000'}}, 0x24)
r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000380), 0x400000, 0x0)
ioctl$mixer_OSS_ALSAEMULVER(r3, 0x80044df9, &(0x7f00000003c0))
write$P9_RLINK(r1, &(0x7f0000000400)={0x7, 0x47, 0x2}, 0x7)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000440)={0x7, 0x8, {<r4=>r2}, {<r5=>0xee01}, 0x20, 0xf82})
getresgid(&(0x7f0000000480), &(0x7f00000004c0)=<r6=>0x0, &(0x7f0000000500))
r7 = geteuid()
write$P9_RSTATu(r0, &(0x7f0000000540)={0x75, 0x7d, 0x1, {{0x0, 0x58, 0x6, 0x4, {0x2, 0x2, 0x1}, 0x40000, 0xffffffff, 0x100, 0x1, 0xb, '/dev/mixer\x00', 0x9, ':+/+{!\x12,{', 0xb, '/dev/mixer\x00', 0x6, '9P2000'}, 0x8, '[%.:(}O/', r5, r6, r7}}, 0x75)
write$P9_RLINK(r0, &(0x7f00000005c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RFLUSH(r0, &(0x7f0000000600)={0x7, 0x6d, 0x1}, 0x7)
write$P9_RLOPEN(r1, &(0x7f0000000640)={0x18, 0xd, 0x1, {{0x20, 0x2}, 0x24b}}, 0x18)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000680))
write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f00000006c0)={0x23, 0x37, 0x2, {0x0, 0x6, 0x5, r4, 0x5, '/!^d/'}}, 0x23)
write$P9_RSYMLINK(r0, &(0x7f0000000700)={0x14, 0x11, 0x1, {0x9f5360087d71f800, 0x4, 0x1}}, 0x14)
r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000740), 0x44840, 0x0)
ioctl$SOUND_MIXER_INFO(r8, 0x805c4d65, &(0x7f0000000780))
prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x3, &(0x7f0000000800))
write$P9_RRENAME(0xffffffffffffffff, &(0x7f0000000880)={0x7, 0x15, 0x2}, 0x7)

17:41:09 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:09 executing program 4:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:09 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r4=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f00000003c0))
r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r7, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r6, 0x40106436, &(0x7f0000000480)={r3, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f00000004c0)={r4, <r8=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r8})
write$ppp(0xffffffffffffffff, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)

[  746.856482][ T1376] ieee802154 phy0 wpan0: encryption failed: -22
[  746.862903][ T1376] ieee802154 phy1 wpan1: encryption failed: -22
17:41:10 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:11 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
socket$pptp(0x18, 0x1, 0x2)

17:41:11 executing program 0:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)

17:41:12 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r4, 0x8010743f, &(0x7f00000003c0))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:13 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)

17:41:13 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:13 executing program 0:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)

17:41:14 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)

17:41:14 executing program 3:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r2, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)

17:41:15 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:15 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
socket$pptp(0x18, 0x1, 0x2)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
socket$pptp(0x18, 0x1, 0x2)
openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)

17:41:15 executing program 0:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080), 0x80000)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {0xee01}, 0x91, 0x3})
socket$pptp(0x18, 0x1, 0x2)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RAUTH(0xffffffffffffffff, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
socket$pptp(0x18, 0x1, 0x2)
openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)

17:41:16 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:17 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:17 executing program 3:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
socket$pptp(0x18, 0x1, 0x2)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
socket$pptp(0x18, 0x1, 0x2)
openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)

17:41:17 executing program 0:
pipe2$9p(0x0, 0x84000)
write$P9_RLINK(0xffffffffffffffff, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {0xee01}, 0x91, 0x3})
socket$pptp(0x18, 0x1, 0x2)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RAUTH(0xffffffffffffffff, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
socket$pptp(0x18, 0x1, 0x2)
openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)

17:41:18 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)

17:41:18 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r0})
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:19 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:19 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r3=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r3, 0x401})
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:19 executing program 3:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:20 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)

17:41:20 executing program 0:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:21 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, 0x0, 0x10001})
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:21 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:21 executing program 3:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)

17:41:22 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001680), 0x4e000, 0x0)
write$ppp(r7, &(0x7f00000016c0)="7be74575f25ff40c64", 0x9)
r8 = syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)
ioctl$DRM_IOCTL_GEM_OPEN(r8, 0xc010640b, &(0x7f0000001780))

17:41:22 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:23 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {r2}, 0x7, 0x3})
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:24 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:28 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x84000)
write$P9_RWRITE(r0, &(0x7f0000000040)={0xb, 0x77, 0x1, 0x7}, 0xb)
pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$P9_RLINK(r1, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RLCREATE(r1, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x1}, 0x8001}}, 0x18)
write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x1, {{0x8, 0x2, 0x5}, 0x7fff}}, 0x18)
r2 = geteuid()
getresgid(&(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0), &(0x7f0000000200))
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x1, 0xe8a3, {0xffffffffffffffff}, {<r4=>0xee01}, 0x91, 0x3})
write$P9_RSTATu(r0, &(0x7f0000000280)={0x5a, 0x7d, 0x1, {{0x0, 0x3f, 0x6, 0x3, {0x80, 0x2, 0x1}, 0x800000, 0x100, 0x7499, 0x4, 0x7, '-.\\}*$(', 0x1, ':', 0x1, '[', 0x3, ')!-'}, 0x6, '\x00/,@}^', r2, r3, r4}}, 0x5a)
write$P9_RLOPEN(r0, &(0x7f0000000300)={0x18, 0xd, 0x1, {{0x8, 0x4, 0x8}, 0x9}}, 0x18)
write$P9_RATTACH(r0, &(0x7f0000000340)={0x14, 0x69, 0x2, {0x20, 0x4, 0x8}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000000380)={0x18, 0xf, 0x2, {{0x1, 0x3, 0x4}, 0x2}}, 0x18)
write$P9_RLINK(r0, &(0x7f00000003c0)={0x7, 0x47, 0x1}, 0x7)
write$P9_RREAD(r1, &(0x7f0000000400)={0x100b, 0x75, 0x1, {0x1000, "fba05d7bd7587956781c78a5ac1d16daf85492ef708bbb33ceeafe047130f414eab31c316dc6572cf0e00ce6436b096124d08f6f048bb116cbb091b2c0a78714c96a66f2d45981c9ad105f478f49189fc0c72af8236bdf63c7f1b9a7323b47adf6ce28ccf94c4c40e06d45edca74cccd5bda621e80b8125bd26b3f904a99883bc0998da1275018cd52e68672ac485949df5f30cd13a6cb0948ed31c5acf2b7ddad1b9d5615375d7907b25ece65ef921e136f49246ad3fde73150378a08ce51dbcc09cb500eeced3e638b644aace9e21d0e74d40b7fc056d328c17945987693b52940da05d15574b812fb6b36217ed89956cd824e6a6560106efde5dce716c3c4c9fbf787e8b017d1785afb689bec2155f6580e571f42bac400f76a46a8fdcf10798cb18d8a732e29aa6e84c0d989947d0638812e729ba6f00c83b84370d15d1687ecdb5cc7be85e33fce03973e5cf11ca16117cc7453d8691740ea8cdd34eb99c6effa1cd023e477b8bbd566821a61115a2ab870e57e652426177fbb1523f58fce44fb9ab34dd06c3183f1cd46ee3e834607f3dca0b63f16f6d433e7e90cd0ec4c6f603c5b2cbb7b81fd42f16021b10fc3b0e1f209b3eb839804ab8848def86aabae44f8bd03289debad45324a9e77ed705caa65d4ba34150109beb98337f92165cfe39de4a28adf1d4a47e0c2e1182463c21ef05a875cd2eb8585910b46f845bc77d7555fe64ec2915587e80cd80c96f88d594d5e503c69d10d9eb5e92a9a5a278844c1c5da643bf57dee96df2742663a4506af9b11bfad8c64f8aeb67f53f47958db836d15891e567819e192adf231256ba8570f5d5ab3b527778d711354ecbcfedcef24edaa508590e697a9f30ee3ed58df6aa88c57b262b6c04796772f4cc5765c25373dab560532fdc2271e85195f5eb4002565639c1dc236b175ce0308edacfac836217fec26551bc23001ac91b3766783a83b8f826d3aa4742da8cfa7deeb7ddb3f55f3ccf0ddf276fd14ac53440ecdc4b0cf5efa082a3d8fcbd3d93787fefdd1b5ec8886fb887c6b02dc80d980959df643afabd3cc4f0ff4d37abfc63f01193427b80064844a54ea809e650cb4059c42285cce8013c9df8fb65db4d89fc3dd68394c8ea0f535574b9ecb48a9cffb94c4821bad8cfd6ec2860d73dc6ba6154ad8040fc9d1a9f89a192d8f19aac1fba645e9cd25f71c3b5500f85572bb2c1cf29108272ed30eb090137993694b45cb55fc32deb1aa47f0d78f947904876f9ee669ded6b50121e77699d12af4358446a5cec1de2eb8d9bd766d9485340c053bba7bbeaa49a36a205a740d67eba46905786e1c0f8a972d10e2f9f71c9a7380ae9238a68cb3483e43a0278f8fb929d2965c635aa47a1ae37099079af3a47b9840a88112813b8f7ef9f8847e0a561f3f7bdb9e87f4027e5a2e6f6578d3c9cc48e1d2f823ff2b2cd00f417016848a827721f422e7133b986930d39cc9790811bbf9fe594551f9b92d58fb2a2d2d4b24354928b1236e6190aab3efdb8298edad79b29878660cfbcbd7444e84682697402ec505a55f60e1b5572e89a66025d5d5219951062c3890b74ca32361d904eb6a49866a50e14490ffe0ad66793e14ed90d48a8d1bd6961aa7273686b7b6d6e03ecd764d817b9d84426519962d19251f6d8d5fc912e34afc8430f29f081b87b65977ae92cad8195efecbe2adcc886253a8a346f49c5cc6600f2813a88bed050088cb60193bc4fe3f15fffe8a379ebedb7ea02ebc94a006fa7f4ce033c1251f0c03d94c41cde6761e5852b4ab6e53811244cc394311bf07e129d476f1a06724647c42b0647b33b282986775846e18e52b686df4fd3378dbdf2b765ba7d0b175cd4d1f88bdaf28a34b02e46be8c7fd0765d222331bde9eabf45c18261ff1b803726e4316a8dc2812e0c81ae63821ff27edd74247f92d5d60c56600ab190a44c5328adbbddb7962fab8a4802c32d9bf8ddd8b2e26eea49c70e5863538f8044586bebd8c684e0f3784221715eabc932a93428753174e5190456f2d3a0033c3bc32cfe06934a5b3e0094219bf85f2975e8d43e2766a409af107ec6caf5bf5275ff1ae9974f942267b0e70a8ffffa23c05f18d7027b2caf71279ff60fc76985c6292f45fc545fd7d72cfbed43dc24ec746592c123f93c800782f198879ac29b9d53e267c4a45a85f214a9f0e3ab670e8bc0298e52bd5e80b07e7fbc0dc079c14fdd20efeffca5858d8f2f6c29c106342c355f1658dc709cf306433cafcddef66d15327a54efed1a2d2a02a4f8b878b97c481cfbb4f160fcbdb543fb0d75b574ea589a964f8366ae14098f82e96d348e3834dd6ed83d91621ca5cb4e6fd7c5660070ab212d556d81112fe018f3a25137a9d3233376f25e1b41c3250f95b646f24bac1d3704d59bcaeb272fac75cc3a794e99208f17aba3ad1eb71c08fbce3e7cc9b49f88c68e1ba22df8206cd1915d5343c4d818223011419bc95b597de86b65913e5305ae77534459596bc657a93a3b181810082bf8e58e0c86f53eec6dccb694ffcb3a4c1d15ea119d62de56b2679b11c29e7c9c23ee20425815ac722e2425deebd8a63454410ad0947fcfabe663f3ad2d951af2dbb5ef95ed37242a3cfd18861d059cab2ce95f0454ebd867fa74b42e8e498f4de911091aab3cafec57d28f3bc29fe126bb391437e5deca6255cca7034d1f21759f669e2bd20c46f8a3ea3fa59509af57641883fc5165f9951e54354686dddd546f03476bd075b1ab55916cc7d0fa1774e180109c7fcfa6ae094866e4ba79816b847861a0e77d8fa7375ceec591b1ce3ae56349dcca41541bbefbda65978d526b257855792c4083b06111a1bbafa0a0deb71104c9ddfacca829b1ae0ec556c847236c7c58a05c4f666ae5660e451626ab6654239e90a881374b97329f792df2a0e016b4fa80643dc41614dd8a3cac35bc305655d12962a5ac7c51e474f7b2db1160f3c222709a7f97056c2a1cdc73816f52a39d1c81da7af05f29618e28ee3985e7acf0d1f5fd73632a96121810e60e23986f131dc49c104b53665e4f5540e29e854bf982a7a1ec9aec270c84242d0f1e1b14e42d5b3e36080ed8067504ab627bd7f10b9a4f9e15b76414c15a78f122bd317930717e756e6a241f1db4d4dcbf08d5de4dd5d06add2c637e32bf8f50c914c2228c7b207a66fcdbb59513930099fbdc577fefa818b13bd1250c5b10b8baa7d8a699855945343601a8cb74eee327932cc262c7eedd9082ff1bfd4a2c0c5badd2ee4793785cc21ba0d423ff2ec42dc25f1362daaaa9a45f75c850f73ef1e470bc9234bd2aed45cf217958925254de65cd81e22f3c72e08e07e1e312d7fd614264a54d1b9e36e228c14084422ce49f8a54d0b02401b0c6d8cd15be5149632a46abc1ce9e44d45425cac5b7d4b69d823211c8b17b33611e4e7f79453a17fb8546ef801c8e02774dc2fedfd43a194f2fead40aaad1548f6872f5276e137aa1468f6526f5608617f6003c28434f94084f0bde3a93dbbe1e61c63ca34ad054c6036a41ea1633b4aacd32e90a817fdea0d6587b605e6e8777730ad71b6b2a2d3267fe045053d15591adcf80166b8328fe0d19ab201269fb0ae099c77e60ac7ef65809234d6ee287958b99cb55f0b7c3ad67d016448f3f1107f3f9789f99b5b0ed0f132598f03d2c0eb5534b502df884816d19e9120b60fdbeada6e0c324f832f3238586d24bc019f92b0a4fb5f0a879a03484bed0fdfd67edad4d0e374ec958438005de787f40dc92f8027fffa5378f3c041a6d60bc4ef272a86a3aa84fe480ec49b28867a9eaddd91d8a9053fe3cfcf31cf64aa1b28d18820e533f28eca0adaaae729e71272cabcf7fc79c66a59701b4372e3c6608fb6df97b20964e406435a22bd77ae1486867de69b52c9ae2a021476488b63b7cbdd59135b959f58ea5acddcef17d6f8da9acbd8f71e2ed907fc58fbe3fff1fea936f6b4911e45160e4844bab3e92db9180df697504b8d53345792dff2de761134f4d54c1ef17fe0570188cb22a02a2cfbfb98804dfbf0da33cc64ae8db7a95889855dd3a968847ab4ea13f3935c072a764b631e4bf4fbc3803db6a965057f99a2a9daa8c2a164d001ca4c54e1772f674764a39f95e2122266d9d7605df29415319fa70e27dcac0e6e43973bcc0aca21de73c4841c9d3933aa2395f4217346a86d66dce67256c7376c63a5e45819b87cd50c40aaadf93b36b19854d2503434e9538ed62a83cdd5ac7fefa2bfad2fffaf44dcfb22f45e64e22f6f1b7e43da03c6c8bd9861cd93e61d50a9bb68e4418c2c97f25235434892e2fa7e4ccc8a2fc1840d229053084a941011b111c0f2366f48070ab556b754a279104ecc357896936b74f9f412fb1a803b5880b7c984117fda4c7fa1a87baf9996de420eed53d8a510147372c82ebfb1a27c07f3e48fd2bce76ee2a03accabcf3dac43cbe58d455d2eca27f96dbac3da058b70a3363b9adc6dc21c02944477006f4c3ba0ca5545c0235958e4e2361edcae7e75a9c993b78198e7f28bfd43dcdf8b96b75968da5e2b8030b95e9ef228d088b7da56ce4d8e9802aa0cf98c8a6db5d2bf0666ee2f4529985353e6157b906d28cc35d1543037bb29f61cbe575183c8282473b0e366833bc49e6b0782c69ee3632b3d33b7a7ca54a173a54e700ad2d2caec20db8acc8f5db5fd1f13376936d65dedd42933f57142344fc91a8dcccfb4ed802cf483a3b896ffffe6a267601c38a8bd6b718aad26ab19f2f1df8f65c5c9aa3e6cf60054e7c84bb7a593fc3e1a0884f1ac1efe042ad080abe04b6ae75c98b99ed402d7e481d1651d6496325811c1dd85f1fd7fcebbff763bc0bf4ab848160f5c1d4f9515b2ab116197682086c4585871d407c36a8072bc1ef1d832dd26f80f7be22436803d100a1d45c63465c8569376aaaaedc5e288a2cc94d7aa93edec50c66d84bcd4cc273bac85b4bb2dee3eb69c0b5b48655fad71fcf6f27bf78eb3d401a3962e47c44dedc89e2be534fd92366cbbae7cee30a4193863f02320ffd28d86c132542bed72c1084f8cc0c7d20a3f2d920433a4850b32c13ecac131a56c88f542a67968295b95c325f49e5aa17b33dd22eba1b3a367dbdcfb0896c6c5ff6817d9e9b464b1ed73d68a52ac234ce21a54f9d5db41e113603e09dbd745d0fd02033d78a92ec6aedea33b3354b57b6ca96aaf95f50d53c9d870d3bb4e86fa8bd22c512775166226736f2fd3bb6538846f8f14e6d3a7958cf8910340e3d0205b369a80c25b9b0f91872f91ba06f18fc875166ec7b3093c247eedbd7f93e0340503d641903733231052cac501926d6ef277c069a4bf56b139e957ae1af9322e5e8af23dd6b18e268206c9e0d82899d33c3149ab6d2ae6c85c35e0539b6fc1148929eec62489da1ab1d5d29602e24cf0888a67dd8f80e3c3f01dce01dc172e7da4c94694803478cd1d5e85a75345519fcd38bec697d7b1245352b1827d452123ca9fa78d065125ee670647e37ecf35a9282aa64b90907eb853611925fa5d7ff617cf3b2f83a26a9e96117f5241450d1c2debd62c716d1b70fbfda8bdc900236969ecd65f3339aea452c9bf123b1b6bbfa2493d9ddbd59cc17b18654fbf39802fe3c2dc86143bbb6fe0449d25ff7efdd8a44ce3b97ec7856c903c677bfca1628a48674a1945ab34dba242e284efd7a5a1128bf5d4c05ef232994b138910bada847d4f9510ffb97201c39b81bfcfa0be8a87d05ffa00403100e2a1f7a212b64f92e3b8146de1ed67"}}, 0x100b)
write$P9_RLINK(r1, &(0x7f0000001440)={0x7, 0x47, 0x2}, 0x7)
pipe2$9p(&(0x7f0000001480)={0xffffffffffffffff, <r5=>0xffffffffffffffff}, 0x800)
write$P9_RFSYNC(r5, &(0x7f00000014c0)={0x7, 0x33, 0x2}, 0x7)
write$P9_RXATTRCREATE(r5, &(0x7f0000001500)={0x7, 0x21, 0x1}, 0x7)
r6 = socket$pptp(0x18, 0x1, 0x2)
connect$pptp(r6, &(0x7f0000001540)={0x18, 0x2, {0x0, @empty}}, 0x1e)
ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000001580)=0x1)
write$P9_RXATTRCREATE(r1, &(0x7f00000015c0)={0x7, 0x21, 0x2}, 0x7)
write$P9_RAUTH(r5, &(0x7f0000001600)={0x14, 0x67, 0x1, {0x80, 0x1, 0x2}}, 0x14)
write$P9_RLCREATE(r0, &(0x7f0000001640)={0x18, 0xf, 0x1, {{0x20, 0x2, 0x1}, 0x9}}, 0x18)
socket$pptp(0x18, 0x1, 0x2)
syz_open_dev$dri(&(0x7f0000001700), 0x2, 0x28c001)

17:41:28 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:28 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:28 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:29 executing program 0:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {0xee01}, 0x7, 0x4})
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:29 executing program 1:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:29 executing program 3:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:30 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:30 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0xa4, 0x6, {}, {<r2=>0xee01}, 0x7, 0x4})
ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000240)={0x2, 0x2, {r1}, {<r3=>r2}, 0x7, 0x3})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0xff8000, <r4=>0x0, 0x10001})
ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00000002c0)={r4, 0x401})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)={<r5=>0x0, 0x0, r0})
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000340)={0x6, 0x0, 0x2})
r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2001c0, 0x0)
ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f00000003c0))
r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)
r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000440), 0x200280, 0x0)
ioctl$SNAPSHOT_UNFREEZE(r8, 0x3302)
ioctl$DRM_IOCTL_AGP_BIND(r7, 0x40106436, &(0x7f0000000480)={r4, 0x6})
ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f00000004c0)={r5, <r9=>0x0})
ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000500)={r9})
r10 = getgid()
write$P9_RSTATu(r7, &(0x7f0000000540)={0x77, 0x7d, 0x2, {{0x0, 0x54, 0x3f, 0x80000001, {0x4, 0x2}, 0x0, 0x9, 0x4, 0x8966, 0x7, '],+^[}}', 0x2, '{&', 0x9, '/dev/ppp\x00', 0xf, '/dev/dri/card#\x00'}, 0xe, '/dev/snapshot\x00', r3, r10, r2}}, 0x77)
openat$drirender128(0xffffffffffffff9c, &(0x7f00000005c0), 0x6c130c60e16c43e1, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000600)=<r11=>0x0)
connect$nfc_raw(r7, &(0x7f0000000640)={0x27, r11, 0x1, 0x3}, 0x10)
ioctl$SNAPSHOT_GET_IMAGE_SIZE(r7, 0x8008330e, &(0x7f0000000680))
r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x400000, 0x0)
ioctl$PPPIOCGIDLE32(r12, 0x8008743f, &(0x7f0000000700))
ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000740)=0x40)
write$ppp(r12, &(0x7f0000000780)="0466a6c346b6b08509ed6f6f80f7106ca7cfa461baee5a60872435e40d658b931656d01d1ec8dc0576b68c09d27d57a26a179d83e5616f93fb7a2765274f12c4798d852a828704dda8829d5668a363884e54202c78ff872702f98cfbf88c349f411ee52903b4891703ece35a98c29ce5e16a16870352317023b560912091e3d023935a11b1ce6f", 0x87)
write$P9_RVERSION(r7, &(0x7f0000000840)={0x15, 0x65, 0xffff, 0x2, 0x8, '9P2000.L'}, 0x15)
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f0000000880)=[0xfffffffe, 0xffff8000])
ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000008c0)=[0x8, 0x100])
ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0286405, &(0x7f0000000900)={0x1, 0x7ff, {r1}, {r3}, 0x6, 0x7})

17:41:30 executing program 3:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:30 executing program 1:
syz_clone(0x20000000, &(0x7f0000000040)="ad", 0x1, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:41:31 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0)=<r4=>0x0, &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r5, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000640)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x4080)
write$P9_RSYMLINK(r1, &(0x7f0000000680)={0x14, 0x11, 0x2, {0x4, 0x1}}, 0x14)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r7, 0x3309)
r8 = open_tree(r5, &(0x7f0000000700)='./file0/file0\x00', 0x0)
write$P9_RGETATTR(r1, &(0x7f0000000740)={0xa0, 0x19, 0x1, {0x82, {0xa4, 0x2, 0x5}, 0x180, r2, r4, 0x6, 0x7, 0x3, 0x6, 0x3, 0x100000000, 0x8001, 0x48, 0x140, 0x7, 0x5, 0x6, 0x3, 0x6, 0x8}}, 0xa0)
write$P9_RSYMLINK(r0, &(0x7f0000000800)={0x14, 0x11, 0x1, {0x4, 0x3, 0x1}}, 0x14)
write$P9_RLOCK(r6, &(0x7f0000000840)={0x8, 0x35, 0x2, 0x1}, 0x8)
r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000880)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0)
ioctl$SNAPSHOT_PLATFORM_SUPPORT(r9, 0x330f, 0x9)
write$P9_RRENAME(r8, &(0x7f00000008c0)={0x7, 0x15, 0x1}, 0x7)
write$P9_RSTATu(r6, &(0x7f0000000900)={0x67, 0x7d, 0x2, {{0x0, 0x51, 0x3, 0x8f0, {0x80, 0x3, 0x3}, 0x80000, 0x5, 0x3, 0x6, 0x0, '', 0x2, ':!', 0xe, '/dev/snapshot\x00', 0xe, '/dev/snapshot\x00'}, 0x1, '(', r2, 0xee00, r2}}, 0x67)

17:41:31 executing program 0:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0)=<r4=>0x0, &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r5, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000640)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x4080)
write$P9_RSYMLINK(r1, &(0x7f0000000680)={0x14, 0x11, 0x2, {0x4, 0x1}}, 0x14)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r7, 0x3309)
r8 = open_tree(r5, &(0x7f0000000700)='./file0/file0\x00', 0x0)
write$P9_RGETATTR(r1, &(0x7f0000000740)={0xa0, 0x19, 0x1, {0x82, {0xa4, 0x2, 0x5}, 0x180, r2, r4, 0x6, 0x7, 0x3, 0x6, 0x3, 0x100000000, 0x8001, 0x48, 0x140, 0x7, 0x5, 0x6, 0x3, 0x6, 0x8}}, 0xa0)
write$P9_RSYMLINK(r0, &(0x7f0000000800)={0x14, 0x11, 0x1, {0x4, 0x3, 0x1}}, 0x14)
write$P9_RLOCK(r6, &(0x7f0000000840)={0x8, 0x35, 0x2, 0x1}, 0x8)
r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000880)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0)
ioctl$SNAPSHOT_PLATFORM_SUPPORT(r9, 0x330f, 0x9)
write$P9_RRENAME(r8, &(0x7f00000008c0)={0x7, 0x15, 0x1}, 0x7)
write$P9_RSTATu(r6, &(0x7f0000000900)={0x67, 0x7d, 0x2, {{0x0, 0x51, 0x3, 0x8f0, {0x80, 0x3, 0x3}, 0x80000, 0x5, 0x3, 0x6, 0x0, '', 0x2, ':!', 0xe, '/dev/snapshot\x00', 0xe, '/dev/snapshot\x00'}, 0x1, '(', r2, 0xee00, r2}}, 0x67)

17:41:31 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000640), 0x4080)

17:41:31 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000640), 0x4080)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

17:41:31 executing program 3:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0)=<r4=>0x0, &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r5, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000640)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x4080)
write$P9_RSYMLINK(r1, &(0x7f0000000680)={0x14, 0x11, 0x2, {0x4, 0x1}}, 0x14)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r7, 0x3309)
r8 = open_tree(r5, &(0x7f0000000700)='./file0/file0\x00', 0x0)
write$P9_RGETATTR(r1, &(0x7f0000000740)={0xa0, 0x19, 0x1, {0x82, {0xa4, 0x2, 0x5}, 0x180, r2, r4, 0x6, 0x7, 0x3, 0x6, 0x3, 0x100000000, 0x8001, 0x48, 0x140, 0x7, 0x5, 0x6, 0x3, 0x6, 0x8}}, 0xa0)
write$P9_RSYMLINK(r0, &(0x7f0000000800)={0x14, 0x11, 0x1, {0x4, 0x3, 0x1}}, 0x14)
write$P9_RLOCK(r6, &(0x7f0000000840)={0x8, 0x35, 0x2, 0x1}, 0x8)
r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000880)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0)
ioctl$SNAPSHOT_PLATFORM_SUPPORT(r9, 0x330f, 0x9)
write$P9_RRENAME(r8, &(0x7f00000008c0)={0x7, 0x15, 0x1}, 0x7)
write$P9_RSTATu(r6, &(0x7f0000000900)={0x67, 0x7d, 0x2, {{0x0, 0x51, 0x3, 0x8f0, {0x80, 0x3, 0x3}, 0x80000, 0x5, 0x3, 0x6, 0x0, '', 0x2, ':!', 0xe, '/dev/snapshot\x00', 0xe, '/dev/snapshot\x00'}, 0x1, '(', r2, 0xee00, r2}}, 0x67)

17:41:32 executing program 1:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:32 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

[  769.035535][  T144] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
17:41:32 executing program 0:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000640), 0x4080)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

[  769.092309][ T3566] Bluetooth: hci4: command 0x0409 tx timeout
17:41:33 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

17:41:33 executing program 2:
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000400)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0)

17:41:34 executing program 0:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

17:41:34 executing program 3:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000640), 0x4080)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

[  770.783342][  T144] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
17:41:34 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

17:41:34 executing program 1:
openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)

[  771.182310][ T3574] Bluetooth: hci4: command 0x041b tx timeout
17:41:34 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

17:41:35 executing program 2:
openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)

17:41:35 executing program 3:
syz_clone(0x20000000, &(0x7f0000000040), 0x0, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

[  771.724835][T15620] chnl_net:caif_netlink_parms(): no params data found
17:41:35 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0), &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
write$P9_RLOCK(0xffffffffffffffff, &(0x7f0000000840)={0x8, 0x35, 0x2, 0x1}, 0x8)

17:41:35 executing program 0:
syz_clone(0x20000000, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0)

17:41:35 executing program 2:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RCLUNK(r0, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x7, 0x1b, 0x1}, 0x7)
write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x77, 0x1, 0x43b9}, 0xb)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000240)={0x3, 0x0, {}, {<r2=>0x0}, 0xf0, 0x7})
getresgid(&(0x7f0000000280)=<r3=>0x0, &(0x7f00000002c0)=<r4=>0x0, &(0x7f0000000300))
write$P9_RGETATTR(r0, &(0x7f0000000340)={0xa0, 0x19, 0x1, {0x840, {0x1, 0x2, 0x3}, 0xc, r2, r3, 0x7, 0xe702, 0x9f, 0x3, 0x0, 0x0, 0x5, 0x7, 0x6, 0xfc42, 0x8, 0x401, 0x9, 0xe3b, 0x1}}, 0xa0)
write$P9_RCREATE(r0, &(0x7f0000000400)={0x18, 0x73, 0x1, {{0x0, 0x1, 0x2}, 0x597}}, 0x18)
write$P9_RREADDIR(r0, &(0x7f0000000440)={0xea, 0x29, 0x2, {0x1, [{{0x1, 0x4, 0x5}, 0x401, 0xfc, 0x7, './file0'}, {{0x2c, 0x2, 0x4}, 0x4e31, 0xb4, 0x7, './file0'}, {{0x8c, 0x4, 0x8}, 0x3, 0x81, 0x7, './file0'}, {{0x20, 0x2, 0x7}, 0x8, 0xfe, 0xd, './file0/file0'}, {{0x20, 0x2, 0x7}, 0xfdf, 0x9, 0x7, './file0'}, {{0x1, 0x2, 0x7}, 0x8, 0x5, 0x7, './file0'}, {{0x1, 0x4, 0x5}, 0x1, 0xe0, 0x7, './file0'}]}}, 0xea)
write$P9_RLINK(r1, &(0x7f0000000540)={0x7, 0x47, 0x1}, 0x7)
r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580), 0x501002, 0x0)
ioctl$SOUND_MIXER_READ_RECSRC(r5, 0x80044dff, &(0x7f00000005c0))
write$P9_RRENAMEAT(r0, &(0x7f0000000600)={0x7, 0x4b, 0x2}, 0x7)
pipe2$9p(&(0x7f0000000640)={0xffffffffffffffff, <r6=>0xffffffffffffffff}, 0x4080)
write$P9_RSYMLINK(r1, &(0x7f0000000680)={0x14, 0x11, 0x2, {0x4, 0x1}}, 0x14)
r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)
ioctl$SNAPSHOT_FREE_SWAP_PAGES(r7, 0x3309)
r8 = open_tree(r5, &(0x7f0000000700)='./file0/file0\x00', 0x0)
write$P9_RGETATTR(r1, &(0x7f0000000740)={0xa0, 0x19, 0x1, {0x82, {0xa4, 0x2, 0x5}, 0x180, r2, r4, 0x6, 0x7, 0x3, 0x6, 0x3, 0x100000000, 0x8001, 0x48, 0x140, 0x7, 0x5, 0x6, 0x3, 0x6, 0x8}}, 0xa0)
write$P9_RSYMLINK(r0, &(0x7f0000000800)={0x14, 0x11, 0x1, {0x4, 0x3, 0x1}}, 0x14)
write$P9_RLOCK(r6, &(0x7f0000000840)={0x8, 0x35, 0x2, 0x1}, 0x8)
r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000880)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0)
ioctl$SNAPSHOT_PLATFORM_SUPPORT(r9, 0x330f, 0x9)
write$P9_RRENAME(r8, &(0x7f00000008c0)={0x7, 0x15, 0x1}, 0x7)
write$P9_RSTATu(r6, &(0x7f0000000900)={0x67, 0x7d, 0x2, {{0x0, 0x51, 0x3, 0x8f0, {0x80, 0x3, 0x3}, 0x80000, 0x5, 0x3, 0x6, 0x0, '', 0x2, ':!', 0xe, '/dev/snapshot\x00', 0xe, '/dev/snapshot\x00'}, 0x1, '(', r2, 0xee00, r2}}, 0x67)

17:41:35 executing program 3:
openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0)

17:41:35 executing program 1:
pipe2$9p(&(0x7f0000000000), 0x4800)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

17:41:36 executing program 0:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0, <r8=>0xffffffffffffffff}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x20, '\x00', 0x0, r0, 0x1, 0x4}, 0x48)
r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000e40)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x12, &(0x7f0000000c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}, @map_val={0x18, 0x0, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x81}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d00)='syzkaller\x00', 0x80, 0x31, &(0x7f0000000d40)=""/49, 0x40f00, 0x40, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000d80)={0x1, 0xd, 0x2, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[r10, r11, r1, r7]}, 0x90)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000011c0)={0x11, 0x6, &(0x7f0000000fc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0xa2}, @ldst={0x0, 0x2, 0x1, 0x1, 0x6, 0x6, 0xfffffffffffffffc}, @ldst={0x1, 0x1, 0x3, 0xa, 0x9, 0xffffffffffffffff, 0x8}]}, &(0x7f0000001000)='GPL\x00', 0x6, 0xbc, &(0x7f0000001040)=""/188, 0x40f00, 0x40, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000001100)={0x3, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001140)=[r0], &(0x7f0000001180)=[{0x3, 0x2, 0x2, 0x4}, {0x3, 0x3, 0xd, 0x9}, {0x1, 0x2, 0xd, 0xa}], 0x10, 0x5}, 0x90)
r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000012c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x2, '\x00', 0x0, r12, 0x3, 0x3, 0x5}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000015c0)=@bpf_tracing={0x1a, 0x29, &(0x7f0000001340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [@btf_id={0x18, 0xa, 0x3, 0x0, 0x1}, @exit, @tail_call={{0x18, 0x2, 0x1, 0x0, r12}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @exit, @map_idx={0x18, 0x5, 0x5, 0x0, 0xb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, 0x17, r0, 0x8, &(0x7f0000001500)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000001540)={0xffff9016, 0x3, 0x743, 0x3ff}, 0x10, 0x51ce, r0, 0x0, &(0x7f0000001580)=[r9, r3, r13, 0xffffffffffffffff], 0x0, 0x10, 0x80000001}, 0x90)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000027c0)={r7, <r14=>0xffffffffffffffff}, 0x4)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002840)={0x6, 0x10, &(0x7f0000001680)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @generic={0x3, 0x2, 0x3, 0x101, 0x1000}, @ldst={0x3, 0x2, 0x4, 0x9, 0x0, 0x4, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f0000001700)='syzkaller\x00', 0x8, 0x1000, &(0x7f0000001740)=""/4096, 0x40f00, 0x40, '\x00', 0x0, 0x25, r12, 0x8, &(0x7f0000002740)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000002780)={0x3, 0x5, 0xfffffff7, 0x1d53}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000002800)=[r3, r14], 0x0, 0x10, 0x3}, 0x90)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0x101, '\x00', 0x0, r12, 0x2, 0x4}, 0x48)
ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f00000029c0)={0x3, &(0x7f0000002980)=[{0x2, 0x9, 0x20, 0xffffffff}, {0x4, 0x6, 0x7, 0x1}, {0x0, 0x3, 0x6}]})
r15 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002a00), 0xc000, 0x0)
ioctl$PPPIOCGIDLE32(r15, 0x8008743f, &(0x7f0000002a40))

17:41:36 executing program 1:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0, <r8=>0xffffffffffffffff}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x20, '\x00', 0x0, r0, 0x1, 0x4}, 0x48)
r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000e40)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x12, &(0x7f0000000c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}, @map_val={0x18, 0x0, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x81}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d00)='syzkaller\x00', 0x80, 0x31, &(0x7f0000000d40)=""/49, 0x40f00, 0x40, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000d80)={0x1, 0xd, 0x2, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[r10, r11, r1, r7]}, 0x90)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000011c0)={0x11, 0x6, &(0x7f0000000fc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0xa2}, @ldst={0x0, 0x2, 0x1, 0x1, 0x6, 0x6, 0xfffffffffffffffc}, @ldst={0x1, 0x1, 0x3, 0xa, 0x9, 0xffffffffffffffff, 0x8}]}, &(0x7f0000001000)='GPL\x00', 0x6, 0xbc, &(0x7f0000001040)=""/188, 0x40f00, 0x40, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000001100)={0x3, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001140)=[r0], &(0x7f0000001180)=[{0x3, 0x2, 0x2, 0x4}, {0x3, 0x3, 0xd, 0x9}, {0x1, 0x2, 0xd, 0xa}], 0x10, 0x5}, 0x90)
r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000012c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x2, '\x00', 0x0, r12, 0x3, 0x3, 0x5}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000015c0)=@bpf_tracing={0x1a, 0x29, &(0x7f0000001340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [@btf_id={0x18, 0xa, 0x3, 0x0, 0x1}, @exit, @tail_call={{0x18, 0x2, 0x1, 0x0, r12}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @exit, @map_idx={0x18, 0x5, 0x5, 0x0, 0xb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, 0x17, r0, 0x8, &(0x7f0000001500)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000001540)={0xffff9016, 0x3, 0x743, 0x3ff}, 0x10, 0x51ce, r0, 0x0, &(0x7f0000001580)=[r9, r3, r13, 0xffffffffffffffff], 0x0, 0x10, 0x80000001}, 0x90)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000027c0)={r7, <r14=>0xffffffffffffffff}, 0x4)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002840)={0x6, 0x10, &(0x7f0000001680)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @generic={0x3, 0x2, 0x3, 0x101, 0x1000}, @ldst={0x3, 0x2, 0x4, 0x9, 0x0, 0x4, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f0000001700)='syzkaller\x00', 0x8, 0x1000, &(0x7f0000001740)=""/4096, 0x40f00, 0x40, '\x00', 0x0, 0x25, r12, 0x8, &(0x7f0000002740)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000002780)={0x3, 0x5, 0xfffffff7, 0x1d53}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000002800)=[r3, r14], 0x0, 0x10, 0x3}, 0x90)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0x101, '\x00', 0x0, r12, 0x2, 0x4}, 0x48)
ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f00000029c0)={0x3, &(0x7f0000002980)=[{0x2, 0x9, 0x20, 0xffffffff}, {0x4, 0x6, 0x7, 0x1}, {0x0, 0x3, 0x6}]})
r15 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002a00), 0xc000, 0x0)
ioctl$PPPIOCGIDLE32(r15, 0x8008743f, &(0x7f0000002a40))

17:41:36 executing program 2:
pipe2$9p(&(0x7f0000000000), 0x4800)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000006c0), 0x40000, 0x0)

17:41:36 executing program 3:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0, <r8=>0xffffffffffffffff}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x20, '\x00', 0x0, r0, 0x1, 0x4}, 0x48)
r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000e40)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x12, &(0x7f0000000c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}, @map_val={0x18, 0x0, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x81}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d00)='syzkaller\x00', 0x80, 0x31, &(0x7f0000000d40)=""/49, 0x40f00, 0x40, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000d80)={0x1, 0xd, 0x2, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[r10, r11, r1, r7]}, 0x90)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000011c0)={0x11, 0x6, &(0x7f0000000fc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0xa2}, @ldst={0x0, 0x2, 0x1, 0x1, 0x6, 0x6, 0xfffffffffffffffc}, @ldst={0x1, 0x1, 0x3, 0xa, 0x9, 0xffffffffffffffff, 0x8}]}, &(0x7f0000001000)='GPL\x00', 0x6, 0xbc, &(0x7f0000001040)=""/188, 0x40f00, 0x40, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000001100)={0x3, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001140)=[r0], &(0x7f0000001180)=[{0x3, 0x2, 0x2, 0x4}, {0x3, 0x3, 0xd, 0x9}, {0x1, 0x2, 0xd, 0xa}], 0x10, 0x5}, 0x90)
r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000012c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x2, '\x00', 0x0, r12, 0x3, 0x3, 0x5}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000015c0)=@bpf_tracing={0x1a, 0x29, &(0x7f0000001340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [@btf_id={0x18, 0xa, 0x3, 0x0, 0x1}, @exit, @tail_call={{0x18, 0x2, 0x1, 0x0, r12}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @exit, @map_idx={0x18, 0x5, 0x5, 0x0, 0xb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, 0x17, r0, 0x8, &(0x7f0000001500)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000001540)={0xffff9016, 0x3, 0x743, 0x3ff}, 0x10, 0x51ce, r0, 0x0, &(0x7f0000001580)=[r9, r3, r13, 0xffffffffffffffff], 0x0, 0x10, 0x80000001}, 0x90)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000027c0)={r7, <r14=>0xffffffffffffffff}, 0x4)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002840)={0x6, 0x10, &(0x7f0000001680)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @generic={0x3, 0x2, 0x3, 0x101, 0x1000}, @ldst={0x3, 0x2, 0x4, 0x9, 0x0, 0x4, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f0000001700)='syzkaller\x00', 0x8, 0x1000, &(0x7f0000001740)=""/4096, 0x40f00, 0x40, '\x00', 0x0, 0x25, r12, 0x8, &(0x7f0000002740)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000002780)={0x3, 0x5, 0xfffffff7, 0x1d53}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000002800)=[r3, r14], 0x0, 0x10, 0x3}, 0x90)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0x101, '\x00', 0x0, r12, 0x2, 0x4}, 0x48)
ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f00000029c0)={0x3, &(0x7f0000002980)=[{0x2, 0x9, 0x20, 0xffffffff}, {0x4, 0x6, 0x7, 0x1}, {0x0, 0x3, 0x6}]})
r15 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002a00), 0xc000, 0x0)
ioctl$PPPIOCGIDLE32(r15, 0x8008743f, &(0x7f0000002a40))

[  773.262276][   T21] Bluetooth: hci4: command 0x040f tx timeout
17:41:36 executing program 0:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x20, '\x00', 0x0, r0, 0x1, 0x4}, 0x48)

17:41:36 executing program 1:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0, <r8=>0xffffffffffffffff}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x20, '\x00', 0x0, r0, 0x1, 0x4}, 0x48)
r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000e40)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x12, &(0x7f0000000c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}, @map_val={0x18, 0x0, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x81}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d00)='syzkaller\x00', 0x80, 0x31, &(0x7f0000000d40)=""/49, 0x40f00, 0x40, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000d80)={0x1, 0xd, 0x2, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[r10, r11, r1, r7]}, 0x90)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000011c0)={0x11, 0x6, &(0x7f0000000fc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0xa2}, @ldst={0x0, 0x2, 0x1, 0x1, 0x6, 0x6, 0xfffffffffffffffc}, @ldst={0x1, 0x1, 0x3, 0xa, 0x9, 0xffffffffffffffff, 0x8}]}, &(0x7f0000001000)='GPL\x00', 0x6, 0xbc, &(0x7f0000001040)=""/188, 0x40f00, 0x40, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000001100)={0x3, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001140)=[r0], &(0x7f0000001180)=[{0x3, 0x2, 0x2, 0x4}, {0x3, 0x3, 0xd, 0x9}, {0x1, 0x2, 0xd, 0xa}], 0x10, 0x5}, 0x90)
r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000012c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x2, '\x00', 0x0, r12, 0x3, 0x3, 0x5}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000015c0)=@bpf_tracing={0x1a, 0x29, &(0x7f0000001340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [@btf_id={0x18, 0xa, 0x3, 0x0, 0x1}, @exit, @tail_call={{0x18, 0x2, 0x1, 0x0, r12}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @exit, @map_idx={0x18, 0x5, 0x5, 0x0, 0xb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, 0x17, r0, 0x8, &(0x7f0000001500)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000001540)={0xffff9016, 0x3, 0x743, 0x3ff}, 0x10, 0x51ce, r0, 0x0, &(0x7f0000001580)=[r9, r3, r13, 0xffffffffffffffff], 0x0, 0x10, 0x80000001}, 0x90)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000027c0)={r7}, 0x4)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0x101, '\x00', 0x0, r12, 0x2, 0x4}, 0x48)

17:41:37 executing program 2:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0, <r8=>0xffffffffffffffff}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x20, '\x00', 0x0, r0, 0x1, 0x4}, 0x48)
r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000e40)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x12, &(0x7f0000000c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}, @map_val={0x18, 0x0, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x81}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d00)='syzkaller\x00', 0x80, 0x31, &(0x7f0000000d40)=""/49, 0x40f00, 0x40, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000d80)={0x1, 0xd, 0x2, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[r10, r11, r1, r7]}, 0x90)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000011c0)={0x11, 0x6, &(0x7f0000000fc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0xa2}, @ldst={0x0, 0x2, 0x1, 0x1, 0x6, 0x6, 0xfffffffffffffffc}, @ldst={0x1, 0x1, 0x3, 0xa, 0x9, 0xffffffffffffffff, 0x8}]}, &(0x7f0000001000)='GPL\x00', 0x6, 0xbc, &(0x7f0000001040)=""/188, 0x40f00, 0x40, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000001100)={0x3, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001140)=[r0], &(0x7f0000001180)=[{0x3, 0x2, 0x2, 0x4}, {0x3, 0x3, 0xd, 0x9}, {0x1, 0x2, 0xd, 0xa}], 0x10, 0x5}, 0x90)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4}, 0x48)

[  773.532847][  T144] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
17:41:37 executing program 3:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0, <r8=>0xffffffffffffffff}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x20, '\x00', 0x0, r0, 0x1, 0x4}, 0x48)
r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000e40)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x12, &(0x7f0000000c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}, @map_val={0x18, 0x0, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x81}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d00)='syzkaller\x00', 0x80, 0x31, &(0x7f0000000d40)=""/49, 0x40f00, 0x40, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000d80)={0x1, 0xd, 0x2, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[r10, r11, r1, r7]}, 0x90)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4}, 0x48)

17:41:37 executing program 1:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4}, 0x48)

17:41:37 executing program 0:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})

17:41:37 executing program 2:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
r4 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
clock_gettime(0x0, &(0x7f0000000540)={<r5=>0x0, <r6=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000580)={0xcf38, 0xc, 0x4, 0x8, 0x9d8a, {r5, r6/1000+60000}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})
r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x0, '\x00', 0x0, r0, 0x1, 0x4, 0x1}, 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={r0, <r8=>0xffffffffffffffff}, 0x4)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000006c0)={0x0, 0x0, r1})
bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1c, 0x27, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffffa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x3, 0x5, 0x1, 0xc, 0x7ffffffffffffff9}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x10}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='GPL\x00', 0x1, 0x4f, &(0x7f0000000880)=""/79, 0x40f00, 0x1, '\x00', 0x0, 0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000940)={0x1, 0x10, 0x4, 0x7ff}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000980), &(0x7f00000009c0)=[{0x5, 0x5, 0xc}], 0x10, 0xfffffc01}, 0x90)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000ac0)=0x4)
syz_open_dev$video(&(0x7f0000000b00), 0x1, 0x420000)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000000b40)={0x0, 0x7, 0x4, 0x6402, 0x1, {}, {0x3, 0x3, 0x0, 0x3, 0xc4, 0x0, "b98cea96"}, 0x4, 0x4, {}, 0x3f, 0x0, r1})
r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000dc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x20, '\x00', 0x0, r0, 0x1, 0x4}, 0x48)
r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000e40)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0x0, '\x00', 0x0, r0, 0x1, 0x5, 0x2}, 0x48)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x12, &(0x7f0000000c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}, @map_val={0x18, 0x0, 0x2, 0x0, r8, 0x0, 0x0, 0x0, 0x81}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000d00)='syzkaller\x00', 0x80, 0x31, &(0x7f0000000d40)=""/49, 0x40f00, 0x40, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000d80)={0x1, 0xd, 0x2, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[r10, r11, r1, r7]}, 0x90)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000011c0)={0x11, 0x6, &(0x7f0000000fc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0xa2}, @ldst={0x0, 0x2, 0x1, 0x1, 0x6, 0x6, 0xfffffffffffffffc}, @ldst={0x1, 0x1, 0x3, 0xa, 0x9, 0xffffffffffffffff, 0x8}]}, &(0x7f0000001000)='GPL\x00', 0x6, 0xbc, &(0x7f0000001040)=""/188, 0x40f00, 0x40, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f0000001100)={0x3, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001140)=[r0], &(0x7f0000001180)=[{0x3, 0x2, 0x2, 0x4}, {0x3, 0x3, 0xd, 0x9}, {0x1, 0x2, 0xd, 0xa}], 0x10, 0x5}, 0x90)
r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000012c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x2, '\x00', 0x0, r12, 0x3, 0x3, 0x5}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000015c0)=@bpf_tracing={0x1a, 0x29, &(0x7f0000001340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [@btf_id={0x18, 0xa, 0x3, 0x0, 0x1}, @exit, @tail_call={{0x18, 0x2, 0x1, 0x0, r12}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @exit, @map_idx={0x18, 0x5, 0x5, 0x0, 0xb}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000014c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, 0x17, r0, 0x8, &(0x7f0000001500)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000001540)={0xffff9016, 0x3, 0x743, 0x3ff}, 0x10, 0x51ce, r0, 0x0, &(0x7f0000001580)=[r9, r3, r13, 0xffffffffffffffff], 0x0, 0x10, 0x80000001}, 0x90)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000027c0)={r7, <r14=>0xffffffffffffffff}, 0x4)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002840)={0x6, 0x10, &(0x7f0000001680)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @generic={0x3, 0x2, 0x3, 0x101, 0x1000}, @ldst={0x3, 0x2, 0x4, 0x9, 0x0, 0x4, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f0000001700)='syzkaller\x00', 0x8, 0x1000, &(0x7f0000001740)=""/4096, 0x40f00, 0x40, '\x00', 0x0, 0x25, r12, 0x8, &(0x7f0000002740)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000002780)={0x3, 0x5, 0xfffffff7, 0x1d53}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000002800)=[r3, r14], 0x0, 0x10, 0x3}, 0x90)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002900)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0x101, '\x00', 0x0, r12, 0x2, 0x4}, 0x48)
ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f00000029c0)={0x3, &(0x7f0000002980)=[{0x2, 0x9, 0x20, 0xffffffff}, {0x4, 0x6, 0x7, 0x1}, {0x0, 0x3, 0x6}]})
r15 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002a00), 0xc000, 0x0)
ioctl$PPPIOCGIDLE32(r15, 0x8008743f, &(0x7f0000002a40))

17:41:37 executing program 1:
r0 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, 0x0)

17:41:38 executing program 3:
r0 = syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, 0x0)

17:41:38 executing program 2:
syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000580)={0x0, 0x0, 0x4, 0x8, 0x9d8a, {}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})

17:41:38 executing program 1:
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101)
r1 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100)
r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x300b0785a70f846e}, 0x18)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_ext={0x1c, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ldst={0x1, 0x3, 0x0, 0x2, 0x9, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='GPL\x00', 0x7, 0xb5, &(0x7f0000000100)=""/181, 0x41100, 0x2, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f0000000200)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x4, 0x38, 0x80}, 0x10, 0x27fe6, r2, 0x7, &(0x7f0000000340)=[0xffffffffffffffff, r3], &(0x7f0000000380)=[{0x3, 0x3, 0x2, 0xa}, {0x5, 0x4, 0xf, 0x7}, {0x4, 0x4, 0xd, 0xa}, {0x0, 0x5, 0x3, 0x2}, {0x3, 0x5, 0x6, 0xc}, {0x3, 0x3, 0xe, 0xa498b5c41e7462fd}, {0x1, 0x3, 0x4, 0x7}], 0x10, 0x6}, 0x90)
syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, r0, 0x8, '\x00', 0x0, r1, 0x2, 0x4}, 0x48)

17:41:38 executing program 3:
syz_open_dev$swradio(&(0x7f0000000500), 0x1, 0x2)
ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000580)={0x0, 0x0, 0x4, 0x8, 0x9d8a, {}, {0x4, 0x2, 0x7, 0x0, 0x2, 0x5, "7aafd7c8"}, 0x80, 0x4, {}, 0x7})

17:41:38 executing program 0:
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
syz_clone(0x20000000, &(0x7f0000000040)="ad92c07c84a2cacf7656ea2075f7bcd835bcb448c90351bb2a2f91b30983b3aba2a9b6b42aa5731d4e77256304770e2caf354d66bdf014ae07e70c05f96df450c989f5d037374d7a3d6c7f4f9c705a6eb3bb02c31d0d92bc7fc32a288403232df09a2c9a139bcffe9da26a4753f0cd868226354ceccc0ae2ba3920842521d630c302b4689b79efd03255bf1a1f4fdaad81dfb503966e4d07701de365e80ab1bee6e6bcb16d571635ac67bf6ebe815385f9f354f588bba56654b3d6ab7a19f32be090e8e76396bfd49fa839171328e7c3e2f3476b66f25db31b28f7183db7c1ba8e2e8da0867ddfb9397accb19317ecef320ae36e640268", 0xf7, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="33985a6bd1d087355ba37a298c1f57d235a7170c2108")

17:41:38 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:38 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  775.342409][ T3573] Bluetooth: hci4: command 0x0419 tx timeout
[  775.513092][  T144] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
17:41:39 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  775.824591][T15620] bridge0: port 1(bridge_slave_0) entered blocking state
[  775.835595][T15620] bridge0: port 1(bridge_slave_0) entered disabled state
[  775.861728][T15620] device bridge_slave_0 entered promiscuous mode
[  775.891529][T15620] bridge0: port 2(bridge_slave_1) entered blocking state
[  775.919213][T15620] bridge0: port 2(bridge_slave_1) entered disabled state
17:41:39 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  775.937545][T15620] device bridge_slave_1 entered promiscuous mode
17:41:39 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:40 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:40 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:40 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  776.969031][T15620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  777.024937][T15620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
17:41:40 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:41 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:41 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:41 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:41 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  778.269774][T15620] team0: Port device team_slave_0 added
17:41:42 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  778.605055][T15620] team0: Port device team_slave_1 added
17:41:42 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:42 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:42 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:43 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  779.771085][T15620] batman_adv: batadv0: Adding interface: batadv_slave_0
17:41:43 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
gettid()
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  779.812210][T15620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  779.907927][T15620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  780.004533][T15620] batman_adv: batadv0: Adding interface: batadv_slave_1
[  780.011509][T15620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
17:41:43 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:43 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  780.168291][T15620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
17:41:44 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:44 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:44 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:45 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  781.849533][T15620] device hsr_slave_0 entered promiscuous mode
17:41:45 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

[  782.214916][T15620] device hsr_slave_1 entered promiscuous mode
[  782.429586][T15620] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  782.438630][T15620] Cannot create hsr debugfs directory
17:41:46 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:46 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:46 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:46 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:46 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:47 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:47 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:47 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:48 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:48 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:48 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:48 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:49 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:49 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(0xffffffffffffffff, 0x80044d05, &(0x7f0000000140))

17:41:49 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:41:49 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:41:50 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)

17:41:50 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)

17:41:50 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r5 = gettid()
syz_pidfd_open(r5, 0x0)

17:41:51 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r2, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r2, r2, r2, r4, r2, r2], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
syz_pidfd_open(0x0, 0x0)

17:41:51 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:52 executing program 1:
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x4800)
write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
write$P9_RXATTRCREATE(r0, &(0x7f0000000080)={0x7, 0x21, 0x1}, 0x7)
write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7)
write$P9_RREADLINK(r0, &(0x7f0000000100)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
open_tree(0xffffffffffffffff, &(0x7f0000000700)='./file0/file0\x00', 0x0)

17:41:52 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:52 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r1, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
r2 = gettid()
syz_pidfd_open(r2, 0x0)

17:41:52 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:52 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:53 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:53 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:53 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:41:53 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:54 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:54 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:54 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:54 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:54 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:41:54 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  791.537649][T15620] netdevsim netdevsim4 netdevsim0: renamed from eth0
17:41:55 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)

17:41:55 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  792.012877][T15620] netdevsim netdevsim4 netdevsim1: renamed from eth1
17:41:55 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  792.154241][T15620] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  792.987330][T15620] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  800.866359][T15620] 8021q: adding VLAN 0 to HW filter on device bond0
[  800.931362][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  800.953007][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  800.964061][T15620] 8021q: adding VLAN 0 to HW filter on device team0
[  800.990259][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  801.007957][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  801.043327][ T3574] bridge0: port 1(bridge_slave_0) entered blocking state
[  801.050413][ T3574] bridge0: port 1(bridge_slave_0) entered forwarding state
[  801.143318][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  801.151908][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  801.182820][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  801.230937][ T3565] bridge0: port 2(bridge_slave_1) entered blocking state
[  801.238095][ T3565] bridge0: port 2(bridge_slave_1) entered forwarding state
[  801.291393][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  801.323150][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  801.362479][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  801.433705][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  801.463103][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  801.514847][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  801.549722][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  801.580255][ T3565] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  801.621040][T15620] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  801.669470][T15620] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  801.711231][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  801.737738][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  801.767001][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  802.688981][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  802.701811][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  802.741716][T15620] 8021q: adding VLAN 0 to HW filter on device batadv0
[  803.290451][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  803.313874][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  803.372262][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  803.392632][ T3574] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  803.427125][T15620] device veth0_vlan entered promiscuous mode
[  803.460694][T12183] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  803.483341][T12183] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  803.496452][T15620] device veth1_vlan entered promiscuous mode
[  805.629574][T12183] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  805.652792][T12183] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  805.660886][T12183] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  805.719506][T12183] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  805.754510][T15620] device veth0_macvtap entered promiscuous mode
[  805.789009][T12183] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  805.805551][T15620] device veth1_macvtap entered promiscuous mode
[  805.846454][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  805.927730][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  805.942186][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  805.964550][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.002191][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  806.023360][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.072370][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  806.108624][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.140158][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  806.173780][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.213692][T15620] batman_adv: batadv0: Interface activated: batadv_slave_0
[  806.449864][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  806.482958][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  806.493743][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  806.517864][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.564906][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  806.604425][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.656999][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  806.711794][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.739156][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  806.752165][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.761988][T15620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  806.838591][T15620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  806.867163][T15620] batman_adv: batadv0: Interface activated: batadv_slave_1
[  807.567146][  T144] device hsr_slave_0 left promiscuous mode
[  808.002518][  T144] device hsr_slave_1 left promiscuous mode
[  808.242445][  T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  808.249890][  T144] batman_adv: batadv0: Removing interface: batadv_slave_0
[  808.294509][ T1376] ieee802154 phy0 wpan0: encryption failed: -22
[  808.306311][ T1376] ieee802154 phy1 wpan1: encryption failed: -22
[  808.559540][  T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  808.582224][  T144] batman_adv: batadv0: Removing interface: batadv_slave_1
[  808.685826][  T144] device bridge_slave_1 left promiscuous mode
[  808.692090][  T144] bridge0: port 2(bridge_slave_1) entered disabled state
[  809.039313][  T144] device bridge_slave_0 left promiscuous mode
[  809.050664][  T144] bridge0: port 1(bridge_slave_0) entered disabled state
[  810.242482][  T144] device veth1_macvtap left promiscuous mode
[  810.248559][  T144] device veth0_macvtap left promiscuous mode
[  810.272244][  T144] device veth1_vlan left promiscuous mode
[  810.278089][  T144] device veth0_vlan left promiscuous mode
17:42:20 executing program 3:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

17:42:20 executing program 1:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000940)=0x4)
syz_open_dev$video(&(0x7f0000000980), 0x2, 0x41e840)
r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r4, 0x0, '\x00', 0x0, r3, 0x0, 0x3, 0x4}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1f, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_val={0x18, 0x4, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0x7}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @map_val={0x18, 0x3, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xfffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000b40)='GPL\x00', 0x0, 0x6a, &(0x7f0000000b80)=""/106, 0x40f00, 0x2d, '\x00', 0x0, 0x25, r3, 0x8, &(0x7f0000000c00)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000c40)={0x0, 0xb, 0x0, 0x200}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5514}, 0x90)
write$P9_RCREATE(r3, &(0x7f0000000d40)={0x18, 0x73, 0x1, {{0x8, 0x0, 0x6}, 0xff}}, 0x18)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000dc0), 0x82080, 0x0)
write$P9_RWRITE(r3, &(0x7f0000000e00)={0xb, 0x77, 0x2, 0x2}, 0xb)
r9 = open_tree(r3, &(0x7f0000000e40)='./file0\x00', 0x801)
ioctl$VIDIOC_QUERYBUF_DMABUF(r4, 0xc0585609, &(0x7f0000000e80)={0x7fffffff, 0x6, 0x4, 0x20, 0xfffffffd, {0x77359400}, {0x1, 0x0, 0x1, 0xff, 0x5, 0x7f, "d4241215"}, 0x2, 0x4, {}, 0x4, 0x0, r9})
write$P9_RRENAME(r4, &(0x7f0000000f00)={0x7, 0x15, 0x2}, 0x7)

17:42:20 executing program 2:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  820.212251][ T3565] Bluetooth: hci0: command 0x0409 tx timeout
[  820.932229][ T3565] Bluetooth: hci2: command 0x0409 tx timeout
[  821.092236][ T3565] Bluetooth: hci3: command 0x0409 tx timeout
17:42:25 executing program 0:
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080))
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0)
ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d05, &(0x7f0000000140))
ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f0000000180))
r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1, &(0x7f00000001c0)=@raw=[@alu={0x7, 0x1, 0x5, 0x1, 0x5, 0xc, 0x4}], &(0x7f0000000200)='syzkaller\x00', 0xffffffe1, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x0, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000280)=[{0x5, 0x2, 0x9, 0xb}, {0x3, 0x4, 0x5, 0x8}, {0x3, 0x4, 0xa, 0xa}, {0x3, 0x2, 0x0, 0x9}, {0x4, 0x5, 0x4}, {0x5, 0x5, 0xa34, 0x9}], 0x10, 0x40}, 0x90)
r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x0)
r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x200, '\x00', 0x0, r3, 0x5, 0x0, 0x4}, 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x2, 0x0, 0x3, 0x6, 0x0, 0x6, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x6, 0x9, 0x5, 0x20}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0xf0, &(0x7f0000000440)=""/240, 0x41000, 0x48, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x1, 0xf, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[r3, r3, r3, r5, r3, r3], &(0x7f00000006c0)=[{0x5, 0x3, 0x0, 0xb}, {0x3, 0x5, 0x200, 0x5}, {0x4, 0x5, 0xc, 0x3}, {0x5, 0x1, 0x4, 0xa}], 0x10, 0xff1}, 0x90)
ioctl$VIDIOC_QUERYBUF_DMABUF(r3, 0xc0585609, &(0x7f00000007c0)={0xff, 0x8, 0x4, 0x8, 0x3, {0x0, 0xea60}, {0x2, 0x2, 0x7, 0xc9, 0xff, 0x41, "1f11db09"}, 0x1, 0x4, {}, 0x6})
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000840)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
r6 = gettid()
syz_pidfd_open(r6, 0x0)
r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000880), 0x800, 0x0)
ioctl$SOUND_MIXER_READ_RECMASK(r7, 0x80044dfd, &(0x7f00000008c0))
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000900)=0x1)
openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000d80), 0x48880, 0x0)

[  822.292228][ T3573] Bluetooth: hci0: command 0x041b tx timeout
[  823.022268][ T5985] Bluetooth: hci2: command 0x041b tx timeout
[  823.182233][ T5985] Bluetooth: hci3: command 0x041b tx timeout
[  824.382300][ T3565] Bluetooth: hci0: command 0x040f tx timeout
[  825.092270][ T5985] Bluetooth: hci2: command 0x040f tx timeout
[  825.262232][ T5985] Bluetooth: hci3: command 0x040f tx timeout
[  825.527642][  T144] team0 (unregistering): Port device team_slave_1 removed
[  825.733848][   T13] Bluetooth: hci5: command 0x0409 tx timeout
[  826.150713][  T144] team0 (unregistering): Port device team_slave_0 removed
[  826.452260][ T5985] Bluetooth: hci0: command 0x0419 tx timeout
[  826.841528][  T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  827.172265][ T3573] Bluetooth: hci2: command 0x0419 tx timeout
[  827.332204][ T3573] Bluetooth: hci3: command 0x0419 tx timeout
[  827.549104][  T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  827.812253][ T5985] Bluetooth: hci5: command 0x041b tx timeout
[  829.902357][ T5985] Bluetooth: hci5: command 0x040f tx timeout
[  831.299953][  T144] bond0 (unregistering): Released all slaves
[  831.972855][ T5985] Bluetooth: hci5: command 0x0419 tx timeout
[  832.489060][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  832.503180][ T5986] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  833.599252][T16026] chnl_net:caif_netlink_parms(): no params data found
[  833.638406][T16035] chnl_net:caif_netlink_parms(): no params data found
[  833.681492][T16033] chnl_net:caif_netlink_parms(): no params data found
[  833.694889][T16038] chnl_net:caif_netlink_parms(): no params data found
[  835.492377][ T3573] Bluetooth: hci6: command 0x0409 tx timeout
[  837.582238][   T21] Bluetooth: hci6: command 0x041b tx timeout
[  839.662244][   T21] Bluetooth: hci6: command 0x040f tx timeout
[  840.464673][T16026] bridge0: port 1(bridge_slave_0) entered blocking state
[  840.471762][T16026] bridge0: port 1(bridge_slave_0) entered disabled state
[  840.520706][T16026] device bridge_slave_0 entered promiscuous mode
[  840.555684][T16026] bridge0: port 2(bridge_slave_1) entered blocking state
[  840.594640][T16026] bridge0: port 2(bridge_slave_1) entered disabled state
[  840.613201][T16026] device bridge_slave_1 entered promiscuous mode
[  840.658022][T16035] bridge0: port 1(bridge_slave_0) entered blocking state
[  840.665340][T16035] bridge0: port 1(bridge_slave_0) entered disabled state
[  840.683244][T16035] device bridge_slave_0 entered promiscuous mode
[  841.703930][T16038] bridge0: port 1(bridge_slave_0) entered blocking state
[  841.711025][T16038] bridge0: port 1(bridge_slave_0) entered disabled state
[  841.742383][T12183] Bluetooth: hci6: command 0x0419 tx timeout
[  841.753362][T16038] device bridge_slave_0 entered promiscuous mode
[  842.663330][T16035] bridge0: port 2(bridge_slave_1) entered blocking state
[  842.670844][T16035] bridge0: port 2(bridge_slave_1) entered disabled state
[  842.708645][T16035] device bridge_slave_1 entered promiscuous mode
[  842.914398][T16033] bridge0: port 1(bridge_slave_0) entered blocking state
[  842.962242][T16033] bridge0: port 1(bridge_slave_0) entered disabled state
[  842.970290][T16033] device bridge_slave_0 entered promiscuous mode
[  843.017035][T16038] bridge0: port 2(bridge_slave_1) entered blocking state
[  843.025001][T16038] bridge0: port 2(bridge_slave_1) entered disabled state
[  843.073221][T16038] device bridge_slave_1 entered promiscuous mode
[  843.097440][T16026] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  843.114755][T16026] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  843.830999][T16035] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  843.881004][T16033] bridge0: port 2(bridge_slave_1) entered blocking state
[  843.889526][T16033] bridge0: port 2(bridge_slave_1) entered disabled state
[  843.908614][T16033] device bridge_slave_1 entered promiscuous mode
[  845.006518][T16026] team0: Port device team_slave_0 added
[  845.024501][T16035] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  846.165478][T16038] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  846.393406][T16026] team0: Port device team_slave_1 added
[  847.625673][T16033] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  847.674123][T16033] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  847.746694][T16038] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  848.395667][T16035] team0: Port device team_slave_0 added
[  850.208168][T16026] batman_adv: batadv0: Adding interface: batadv_slave_0
[  850.222212][T16026] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  850.322206][T16026] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  850.354990][T16035] team0: Port device team_slave_1 added
[  850.364180][T16046] chnl_net:caif_netlink_parms(): no params data found
[  850.394328][T16033] team0: Port device team_slave_0 added
[  850.415350][T16038] team0: Port device team_slave_0 added
[  850.421807][T16026] batman_adv: batadv0: Adding interface: batadv_slave_1
[  850.432195][T16026] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  850.532575][T16026] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  851.340565][T16033] team0: Port device team_slave_1 added
[  851.376977][T16038] team0: Port device team_slave_1 added
[  851.401914][T16035] batman_adv: batadv0: Adding interface: batadv_slave_0
[  851.416650][T16035] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  851.512836][T16035] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  853.026217][T16035] batman_adv: batadv0: Adding interface: batadv_slave_1
[  853.072146][T16035] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  853.222226][T16035] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  853.549871][T16033] batman_adv: batadv0: Adding interface: batadv_slave_0
[  853.582232][T16033] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  853.705231][T16033] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  853.752908][T16038] batman_adv: batadv0: Adding interface: batadv_slave_0
[  853.760089][T16038] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  853.848964][T16038] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  854.365221][T16026] device hsr_slave_0 entered promiscuous mode
[  854.498753][T16026] device hsr_slave_1 entered promiscuous mode
[  854.612308][T16026] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  854.619926][T16026] Cannot create hsr debugfs directory
[  854.674515][T16033] batman_adv: batadv0: Adding interface: batadv_slave_1
[  854.681478][T16033] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  854.800056][T16033] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  854.812855][T16038] batman_adv: batadv0: Adding interface: batadv_slave_1
[  854.819811][T16038] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  854.943894][T16038] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  863.121161][T16035] device hsr_slave_0 entered promiscuous mode
[  863.128184][T16035] device hsr_slave_1 entered promiscuous mode
[  863.375446][T16035] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  863.392197][T16035] Cannot create hsr debugfs directory
[  863.397818][T16046] bridge0: port 1(bridge_slave_0) entered blocking state
[  863.412207][T16046] bridge0: port 1(bridge_slave_0) entered disabled state
[  863.442235][T16046] device bridge_slave_0 entered promiscuous mode
[  863.904988][T16038] device hsr_slave_0 entered promiscuous mode
[  864.019065][T16038] device hsr_slave_1 entered promiscuous mode
[  864.127821][T16038] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  864.156492][T16038] Cannot create hsr debugfs directory
[  866.225925][T16033] device hsr_slave_0 entered promiscuous mode
[  866.323260][T16033] device hsr_slave_1 entered promiscuous mode
[  866.527167][T16033] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  866.552821][T16033] Cannot create hsr debugfs directory
[  866.807259][T16046] bridge0: port 2(bridge_slave_1) entered blocking state
[  866.817032][T16046] bridge0: port 2(bridge_slave_1) entered disabled state
[  866.841464][T16046] device bridge_slave_1 entered promiscuous mode
[  867.407649][T16046] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  867.884642][T16046] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  869.742479][ T1376] ieee802154 phy0 wpan0: encryption failed: -22
[  869.748822][ T1376] ieee802154 phy1 wpan1: encryption failed: -22
[  869.982406][T16046] team0: Port device team_slave_0 added
[  871.075552][T16046] team0: Port device team_slave_1 added
[  873.121063][T16046] batman_adv: batadv0: Adding interface: batadv_slave_0
[  873.152450][T16046] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  873.252275][T16046] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  873.675346][T16046] batman_adv: batadv0: Adding interface: batadv_slave_1
[  873.689760][T16046] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  873.801842][T16046] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  874.975478][T16046] device hsr_slave_0 entered promiscuous mode
[  875.178466][T16046] device hsr_slave_1 entered promiscuous mode
[  875.443619][T16046] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  875.452641][T16046] Cannot create hsr debugfs directory
[  876.683130][  T144] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  878.003190][  T144] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  879.223315][  T144] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  880.522924][  T144] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  881.983488][T16035] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  882.713220][  T144] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  883.302669][T16035] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  884.320887][  T144] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  885.322601][T16035] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  885.930023][  T144] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  886.302549][ T5986] Bluetooth: hci4: command 0x0409 tx timeout
[  887.022977][T16035] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  887.182426][ T5985] Bluetooth: hci7: command 0x0409 tx timeout
[  887.252228][ T1280] Bluetooth: hci8: command 0x0409 tx timeout
[  887.773091][  T144] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  888.373238][ T5986] Bluetooth: hci4: command 0x041b tx timeout
[  888.733817][T16143] chnl_net:caif_netlink_parms(): no params data found
[  889.254844][   T21] Bluetooth: hci7: command 0x041b tx timeout
[  889.342294][   T21] Bluetooth: hci8: command 0x041b tx timeout
[  890.155675][T16141] chnl_net:caif_netlink_parms(): no params data found
[  890.219046][T16137] chnl_net:caif_netlink_parms(): no params data found
[  890.452270][   T21] Bluetooth: hci4: command 0x040f tx timeout
[  890.643672][T16143] bridge0: port 1(bridge_slave_0) entered blocking state
[  890.650769][T16143] bridge0: port 1(bridge_slave_0) entered disabled state
[  890.680619][T16143] device bridge_slave_0 entered promiscuous mode
[  890.835485][T16143] bridge0: port 2(bridge_slave_1) entered blocking state
[  890.842809][T16143] bridge0: port 2(bridge_slave_1) entered disabled state
[  890.863974][T16143] device bridge_slave_1 entered promiscuous mode
[  891.342417][ T5986] Bluetooth: hci7: command 0x040f tx timeout
[  891.422309][   T21] Bluetooth: hci8: command 0x040f tx timeout
[  891.902212][ T5985] Bluetooth: hci9: command 0x0409 tx timeout
[  892.458460][T16143] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  892.532359][ T3566] Bluetooth: hci4: command 0x0419 tx timeout
[  893.325656][T16143] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  893.412413][ T1066] Bluetooth: hci7: command 0x0419 tx timeout
[  893.492327][ T1066] Bluetooth: hci8: command 0x0419 tx timeout
[  893.972331][ T3646] Bluetooth: hci9: command 0x041b tx timeout
[  896.052280][ T3646] Bluetooth: hci9: command 0x040f tx timeout
[  896.528872][T16141] bridge0: port 1(bridge_slave_0) entered blocking state
[  896.541006][T16141] bridge0: port 1(bridge_slave_0) entered disabled state
[  896.563345][T16141] device bridge_slave_0 entered promiscuous mode
[  896.616725][T16137] bridge0: port 1(bridge_slave_0) entered blocking state
[  896.632237][T16137] bridge0: port 1(bridge_slave_0) entered disabled state
[  896.662422][T16137] device bridge_slave_0 entered promiscuous mode
[  896.693685][T16143] team0: Port device team_slave_0 added
[  898.132316][ T3646] Bluetooth: hci9: command 0x0419 tx timeout
[  898.359812][T16141] bridge0: port 2(bridge_slave_1) entered blocking state
[  898.371691][T16141] bridge0: port 2(bridge_slave_1) entered disabled state
[  898.387597][T16141] device bridge_slave_1 entered promiscuous mode
[  898.397844][T16137] bridge0: port 2(bridge_slave_1) entered blocking state
[  898.418273][T16137] bridge0: port 2(bridge_slave_1) entered disabled state
[  898.431053][T16137] device bridge_slave_1 entered promiscuous mode
[  898.453021][T16143] team0: Port device team_slave_1 added
[  900.773873][T16143] batman_adv: batadv0: Adding interface: batadv_slave_0
[  900.780855][T16143] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  900.894193][T16143] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  901.454747][T16141] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  901.485358][T16137] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  901.513120][T16143] batman_adv: batadv0: Adding interface: batadv_slave_1
[  901.520088][T16143] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  901.572358][ T5985] Bluetooth: hci3: command 0x0409 tx timeout
[  901.632148][T16143] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  901.675461][T16170] chnl_net:caif_netlink_parms(): no params data found
[  901.707281][T16141] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  901.732524][T16137] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  903.221564][T16143] device hsr_slave_0 entered promiscuous mode
[  903.308162][T16143] device hsr_slave_1 entered promiscuous mode
[  903.435918][T16143] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  903.451575][T16143] Cannot create hsr debugfs directory
[  903.481784][T16141] team0: Port device team_slave_0 added
[  903.652491][ T1280] Bluetooth: hci3: command 0x041b tx timeout
[  903.854037][T16137] team0: Port device team_slave_0 added
[  904.995928][T16141] team0: Port device team_slave_1 added
[  905.002922][T16137] team0: Port device team_slave_1 added
[  905.732206][ T1280] Bluetooth: hci3: command 0x040f tx timeout
[  906.306608][T16141] batman_adv: batadv0: Adding interface: batadv_slave_0
[  906.323864][T16141] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  906.423870][T16141] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  906.463793][T16137] batman_adv: batadv0: Adding interface: batadv_slave_0
[  906.471243][T16137] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  906.572175][T16137] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  906.647813][T16141] batman_adv: batadv0: Adding interface: batadv_slave_1
[  906.662140][T16141] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  906.832161][T16141] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  907.812231][ T3563] Bluetooth: hci3: command 0x0419 tx timeout
[  908.335101][T16137] batman_adv: batadv0: Adding interface: batadv_slave_1
[  908.352173][T16137] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  908.446309][T16137] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  908.507338][T16170] bridge0: port 1(bridge_slave_0) entered blocking state
[  908.515104][T16170] bridge0: port 1(bridge_slave_0) entered disabled state
[  908.593416][T16170] device bridge_slave_0 entered promiscuous mode
[  908.642229][T16170] bridge0: port 2(bridge_slave_1) entered blocking state
[  908.649333][T16170] bridge0: port 2(bridge_slave_1) entered disabled state
[  908.683096][T16170] device bridge_slave_1 entered promiscuous mode
[  909.103048][T16038] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  911.060294][T16038] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  911.359959][T16170] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  911.705144][T16141] device hsr_slave_0 entered promiscuous mode
[  911.782858][T16141] device hsr_slave_1 entered promiscuous mode
[  911.892513][T16141] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  911.900523][T16141] Cannot create hsr debugfs directory
[  912.285247][T16137] device hsr_slave_0 entered promiscuous mode
[  912.432686][T16137] device hsr_slave_1 entered promiscuous mode
[  912.562315][T16137] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  912.582850][T16137] Cannot create hsr debugfs directory
[  912.590506][T16170] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  912.613507][   T27] INFO: task syz-executor.0:15215 blocked for more than 143 seconds.
[  912.621827][   T27]       Not tainted 5.15.152-syzkaller #0
[  912.642250][   T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  912.650952][   T27] task:syz-executor.0  state:D stack:22840 pid:15215 ppid: 11156 flags:0x00004006
[  912.713108][   T27] Call Trace:
[  912.716471][   T27]  <TASK>
[  912.719431][   T27]  __schedule+0x12c4/0x45b0
[  912.762244][   T27]  ? lockdep_hardirqs_on_prepare+0x438/0x7a0
[  912.768373][   T27]  ? print_irqtrace_events+0x210/0x210
[  912.802192][   T27]  ? do_raw_spin_unlock+0x137/0x8b0
[  912.807481][   T27]  ? _raw_spin_unlock_irqrestore+0x8b/0x130
[  912.842200][   T27]  ? __sched_text_start+0x8/0x8
[  912.847107][   T27]  ? __might_sleep+0xc0/0xc0
[  912.851796][   T27]  ? prepare_to_wait_event+0x3aa/0x3e0
[  912.902199][   T27]  schedule+0x11b/0x1f0
[  912.906458][   T27]  wb_wait_for_completion+0x164/0x290
[  912.911941][   T27]  ? __bpf_trace_writeback_inode_template+0x20/0x20
[  912.962181][   T27]  ? init_wait_entry+0xd0/0xd0
[  912.967011][   T27]  __writeback_inodes_sb_nr+0x2ce/0x370
[  912.992174][   T27]  ? writeback_inodes_sb_nr+0x30/0x30
[  912.997613][   T27]  ? down_read_trylock+0x24a/0x3b0
[  913.032183][   T27]  ? try_to_writeback_inodes_sb+0x1d/0xb0
[  913.037964][   T27]  ? ktime_get_coarse_real_ts64+0x36/0x120
[  913.082186][   T27]  ? cpumask_next+0xc3/0xf0
[  913.086806][   T27]  ? get_nr_dirty_inodes+0x25f/0x2e0
[  913.097821][   T27]  try_to_writeback_inodes_sb+0x94/0xb0
[  913.115268][   T27]  ext4_da_write_begin+0x228/0xb60
[  913.120487][   T27]  ? ext4_set_page_dirty+0x340/0x340
[  913.162181][   T27]  ? current_time+0x1af/0x2f0
[  913.166974][   T27]  ? atime_needs_update+0x7b0/0x7b0
[  913.198306][   T27]  generic_perform_write+0x2bf/0x5b0
[  913.216959][   T27]  ? grab_cache_page_write_begin+0x90/0x90
[  913.226772][   T27]  ? ext4_write_checks+0x255/0x2c0
[  913.231994][   T27]  ext4_buffered_write_iter+0x227/0x360
[  913.272179][   T27]  ext4_file_write_iter+0x87c/0x1990
[  913.277514][   T27]  ? _raw_spin_unlock+0x24/0x40
[  913.310347][   T27]  ? follow_page_pte+0xad5/0xb60
[  913.322189][   T27]  ? follow_page_mask+0xb59/0x13f0
[  913.332900][   T27]  ? ext4_file_read_iter+0x6c0/0x6c0
[  913.338218][   T27]  ? follow_page+0x130/0x130
[  913.359068][   T27]  ? find_vma+0xd3/0x230
[  913.375947][   T27]  ? check_vma_flags+0x407/0x490
[  913.380926][   T27]  ? iov_iter_kvec+0x4a/0x170
[  913.407925][   T27]  __kernel_write+0x5b1/0xa60
[  913.442315][   T27]  ? vfs_read+0xe10/0xe10
[  913.446697][   T27]  ? __lock_acquire+0x1ff0/0x1ff0
[  913.451759][   T27]  ? down_read_killable+0x1d2/0x350
[  913.493851][   T27]  __dump_emit+0x264/0x3a0
[  913.498401][   T27]  ? wait_for_dump_helpers+0x3d0/0x3d0
[  913.522631][   T27]  ? dump_emit+0x152/0x3f0
[  913.527122][   T27]  dump_user_range+0x91/0x320
[  913.544695][   T27]  elf_core_dump+0x3c7d/0x4570
[  913.592155][   T27]  ? reacquire_held_locks+0x660/0x660
[  913.597592][   T27]  ? load_elf_library+0xa40/0xa40
[  913.622237][   T27]  ? mark_lock+0x98/0x340
[  913.626619][   T27]  ? __lock_acquire+0x1295/0x1ff0
[  913.631807][   T27]  ? rcu_read_lock_any_held+0xb3/0x160
[  913.682276][   T27]  ? kmem_cache_alloc+0x128/0x280
[  913.687422][   T27]  do_coredump+0x1852/0x31e0
[  913.692051][   T27]  ? ____kasan_slab_free+0xd8/0x120
[  913.727915][   T27]  ? slab_free_freelist_hook+0xdd/0x160
[  913.733900][   T27]  ? nfs_ssc_unregister+0x30/0x30
[  913.739305][   T27]  ? get_signal+0x8ac/0x14e0
[  913.754573][   T27]  ? do_raw_spin_unlock+0x137/0x8b0
[  913.759809][   T27]  ? _raw_spin_unlock_irq+0x1f/0x40
[  913.812426][   T27]  ? lockdep_hardirqs_on+0x94/0x130
[  913.817723][   T27]  get_signal+0xc06/0x14e0
[  913.835658][   T27]  arch_do_signal_or_restart+0xc3/0x1890
[  913.862141][   T27]  ? lockdep_hardirqs_on+0x94/0x130
[  913.867390][   T27]  ? _raw_spin_unlock_irqrestore+0xd9/0x130
[  913.876165][   T27]  ? _raw_spin_unlock+0x40/0x40
[  913.902200][   T27]  ? get_sigframe_size+0x10/0x10
[  913.907191][   T27]  ? force_sig_info_to_task+0x34a/0x470
[  913.952197][   T27]  ? force_sig+0x114/0x1d0
[  913.956669][   T27]  ? exit_to_user_mode_loop+0x39/0x130
[  913.982215][   T27]  exit_to_user_mode_loop+0x97/0x130
[  913.987547][   T27]  exit_to_user_mode_prepare+0xb1/0x140
[  914.004799][   T27]  irqentry_exit_to_user_mode+0x5/0x40
[  914.032130][   T27]  exc_general_protection+0x358/0x4f0
[  914.037548][   T27]  ? vtime_user_enter+0x1eb/0x2d0
[  914.055400][   T27]  ? __context_tracking_enter+0x5f/0x90
[  914.102238][   T27]  asm_exc_general_protection+0x22/0x30
[  914.107828][   T27] RIP: 0033:0x7f71ba4d1db1
[  914.132551][   T27] RSP: 002b:0000000020000130 EFLAGS: 00010217
[  914.138655][   T27] RAX: 0000000000000000 RBX: 00007f71ba5fff80 RCX: 00007f71ba4d1da9
[  914.163692][   T27] RDX: 0000000020000140 RSI: 0000000020000130 RDI: 0000000020000000
[  914.171698][   T27] RBP: 00007f71ba51e47a R08: 00000000200001c0 R09: 00000000200001c0
[  914.232160][   T27] R10: 0000000020000180 R11: 0000000000000206 R12: 0000000000000000
[  914.240173][   T27] R13: 000000000000000b R14: 00007f71ba5fff80 R15: 00007ffd4096f0e8
[  914.282171][   T27]  </TASK>
[  914.302212][   T27] 
[  914.302212][   T27] Showing all locks held in the system:
[  914.309957][   T27] 3 locks held by kworker/0:1/13:
[  914.351700][   T27]  #0: ffff888011c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0
[  914.372621][   T27]  #1: ffffc90000d27d20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0
[  914.418023][   T27]  #2: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50
[  914.449768][   T27] 1 lock held by khungtaskd/27:
[  914.472228][   T27]  #0: ffffffff8c91f720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
[  914.481620][   T27] 4 locks held by kworker/u4:1/144:
[  914.503581][   T27]  #0: ffff888011dcd138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0
[  914.560269][   T27]  #1: ffffc900010afd20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0
[  914.592233][   T27]  #2: ffffffff8d9cfe50 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60
[  914.601688][   T27]  #3: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: netdev_run_todo+0xa4f/0xc40
[  914.658685][   T27] 4 locks held by kworker/u4:2/145:
[  914.682187][   T27]  #0: ffff88814278e938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0
[  914.709493][   T27]  #1: ffffc900010bfd20 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0
[  914.752227][   T27]  #2: ffff888024684bd8 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1f6/0x3d10
[  914.776338][   T27]  #3: ffff888024686990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x12b9/0x1570
[  914.807430][   T27] 3 locks held by kworker/0:3/1280:
[  914.813974][   T27]  #0: ffff888011c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0
[  914.842497][   T27]  #1: ffffc90005defd20 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0
[  914.874763][   T27]  #2: ffff88807d0a3400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x56/0xab0
[  914.918947][   T27] 1 lock held by dhcpcd/3174:
[  914.924035][   T27]  #0: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: __netlink_dump_start+0x12e/0x6f0
[  914.955450][   T27] 2 locks held by getty/3257:
[  914.963036][   T27]  #0: ffff88814b4b2098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70
[  914.992313][   T27]  #1: ffffc9000209b2e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0
[  915.032225][   T27] 2 locks held by kworker/0:5/3566:
[  915.037474][   T27]  #0: ffff888011c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0
[  915.060586][   T27]  #1: ffffc900031a7d20 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0
[  915.092729][   T27] 3 locks held by kworker/u4:9/10539:
[  915.098344][   T27] 3 locks held by kworker/1:11/12183:
[  915.117447][   T27]  #0: ffff8880b9b3a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140
[  915.139156][   T27]  #1: ffff8880b9b27848 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x53d/0x810
[  915.187330][   T27]  #2: ffff8880b9b29158 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x120/0x260
[  915.208059][   T27] 2 locks held by syz-executor.1/15203:
[  915.219184][   T27] 3 locks held by syz-executor.0/15215:
[  915.244003][   T27]  #0: ffff888024682460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x1825/0x31e0
[  915.282220][   T27]  #1: ffff88805e3bbfc0 (&sb->s_type->i_mutex_key#9){++++}-{3:3}, at: ext4_buffered_write_iter+0xa0/0x360
[  915.308104][   T27]  #2: ffff8880246820e0 (&type->s_umount_key#32){++++}-{3:3}, at: try_to_writeback_inodes_sb+0x1d/0xb0
[  915.342199][   T27] 2 locks held by syz-executor.0/15550:
[  915.347783][   T27]  #0: ffff888024684bd8 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1f6/0x3d10
[  915.402198][   T27]  #1: ffff888024686990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x12b9/0x1570
[  915.411924][   T27] 2 locks held by syz-executor.2/15563:
[  915.449702][   T27] 2 locks held by syz-executor.2/15574:
[  915.467785][   T27] 2 locks held by syz-executor.1/15579:
[  915.513040][   T27] 3 locks held by syz-executor.0/15581:
[  915.532256][   T27] 2 locks held by syz-executor.1/15594:
[  915.537884][   T27] 3 locks held by syz-executor.0/15598:
[  915.578915][   T27] 2 locks held by syz-executor.3/15600:
[  915.602157][   T27] 3 locks held by syz-executor.1/15616:
[  915.607852][   T27] 3 locks held by syz-executor.3/15617:
[  915.642241][   T27] 2 locks held by syz-executor.0/15618:
[  915.647829][   T27] 3 locks held by syz-executor.2/15623:
[  915.682703][   T27] 3 locks held by syz-executor.1/15633:
[  915.688287][   T27] 2 locks held by syz-executor.3/15636:
[  915.722160][   T27] 4 locks held by syz-executor.1/16033:
[  915.727741][   T27]  #0: ffff88807ecf4460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x29a/0xe50
[  915.772322][   T27]  #1: ffff88807854fc88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x4f0
[  915.802221][   T27]  #2: ffff88801bc3a660 (kn->active#233){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x20b/0x4f0
[  915.862161][   T27]  #3: ffffffff8d357a88 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xf1/0x470
[  915.887416][   T27] 8 locks held by syz-executor.0/16038:
[  915.912371][   T27]  #0: ffff88807ecf4460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x29a/0xe50
[  915.921318][   T27]  #1: ffff88805c41ec88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x4f0
[  915.982328][   T27]  #2: ffff88801bc3a660 (kn->active#233){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x20b/0x4f0
[  916.002213][   T27]  #3: ffffffff8d357a88 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xf1/0x470
[  916.042293][   T27]  #4: ffff88807d0a5178 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xc2/0x7f0
[  916.082179][   T27]  #5: ffff88807d0a3400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_reload_destroy+0x118/0x240
[  916.132290][   T27]  #6: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3a/0x140
[  916.141236][   T27]  #7: ffffffff8c923ce8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x280/0x740
[  916.182235][   T27] 4 locks held by syz-executor.4/16046:
[  916.187821][   T27]  #0: ffff88807ecf4460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x29a/0xe50
[  916.232200][   T27]  #1: ffff88806186f888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x4f0
[  916.262260][   T27]  #2: ffff88801bc3a660 (kn->active#233){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x20b/0x4f0
[  916.302196][   T27]  #3: ffffffff8d357a88 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xf1/0x470
[  916.342154][   T27] 1 lock held by syz-executor.3/16137:
[  916.347643][   T27]  #0: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0
[  916.382330][   T27] 1 lock held by syz-executor.1/16141:
[  916.387821][   T27]  #0: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0
[  916.452674][   T27] 1 lock held by syz-executor.2/16143:
[  916.459728][   T27]  #0: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0
[  916.482195][   T27] 1 lock held by syz-executor.0/16170:
[  916.487693][   T27]  #0: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0
[  916.518087][   T27] 1 lock held by syz-executor.4/16192:
[  916.562293][   T27]  #0: ffffffff8d9dba08 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x460/0x2270
[  916.582817][   T27] 
[  916.585185][   T27] =============================================
[  916.585185][   T27] 
[  916.615581][   T27] NMI backtrace for cpu 0
[  916.619946][   T27] CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.152-syzkaller #0
[  916.627933][   T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[  916.638165][   T27] Call Trace:
[  916.641457][   T27]  <TASK>
[  916.644400][   T27]  dump_stack_lvl+0x1e3/0x2cb
[  916.649165][   T27]  ? io_uring_drop_tctx_refs+0x19d/0x19d
[  916.654816][   T27]  ? panic+0x84d/0x84d
[  916.658903][   T27]  ? nmi_cpu_backtrace+0x23b/0x4a0
[  916.664065][   T27]  nmi_cpu_backtrace+0x46a/0x4a0
[  916.669020][   T27]  ? __wake_up_klogd+0xd5/0x100
[  916.673929][   T27]  ? nmi_trigger_cpumask_backtrace+0x2a0/0x2a0
[  916.680095][   T27]  ? _printk+0xd1/0x111
[  916.684267][   T27]  ? panic+0x84d/0x84d
[  916.688344][   T27]  ? __wake_up_klogd+0xcc/0x100
[  916.693204][   T27]  ? panic+0x84d/0x84d
[  916.697278][   T27]  ? __rcu_read_unlock+0x92/0x100
[  916.702314][   T27]  ? arch_trigger_cpumask_backtrace+0x10/0x10
[  916.708564][   T27]  nmi_trigger_cpumask_backtrace+0x181/0x2a0
[  916.714563][   T27]  watchdog+0xe72/0xeb0
[  916.718797][   T27]  kthread+0x3f6/0x4f0
[  916.722883][   T27]  ? hungtask_pm_notify+0x50/0x50
[  916.727924][   T27]  ? kthread_blkcg+0xd0/0xd0
[  916.732526][   T27]  ret_from_fork+0x1f/0x30
[  916.737044][   T27]  </TASK>
[  916.740796][   T27] Sending NMI from CPU 0 to CPUs 1:
[  916.746197][    C1] NMI backtrace for cpu 1
[  916.746208][    C1] CPU: 1 PID: 15574 Comm: syz-executor.2 Not tainted 5.15.152-syzkaller #0
[  916.746227][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[  916.746237][    C1] RIP: 0010:__sanitizer_cov_trace_pc+0x32/0x60
[  916.746261][    C1] Code: e4 35 82 7e 65 8b 15 e5 35 82 7e f7 c2 00 01 ff 00 74 11 f7 c2 00 01 00 00 74 35 83 b9 34 16 00 00 00 74 2c 8b 91 10 16 00 00 <83> fa 02 75 21 48 8b 91 18 16 00 00 48 8b 32 48 8d 7e 01 8b 89 14
[  916.746275][    C1] RSP: 0018:ffffc9000b466f38 EFLAGS: 00000246
[  916.746291][    C1] RAX: ffffffff821d8908 RBX: 0000000000000001 RCX: ffff8880243a3b80
[  916.746304][    C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
[  916.746315][    C1] RBP: ffffc9000b467130 R08: ffffffff821d88fb R09: ffffed1009f10b06
[  916.746328][    C1] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffea0001239d68
[  916.746341][    C1] R13: dffffc0000000000 R14: ffffea0001239d60 R15: 0000000000002db0
[  916.746354][    C1] FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
[  916.746369][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  916.746381][    C1] CR2: 00007fffcf3c3068 CR3: 000000001e703000 CR4: 00000000003506e0
[  916.746396][    C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  916.746406][    C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  916.746416][    C1] Call Trace:
[  916.746421][    C1]  <NMI>
[  916.746427][    C1]  ? nmi_cpu_backtrace+0x39f/0x4a0
[  916.746448][    C1]  ? read_lock_is_recursive+0x10/0x10
[  916.746467][    C1]  ? nmi_trigger_cpumask_backtrace+0x2a0/0x2a0
[  916.746488][    C1]  ? unknown_nmi_error+0xd0/0xd0
[  916.746513][    C1]  ? nmi_cpu_backtrace_handler+0x8/0x10
[  916.746531][    C1]  ? nmi_handle+0xf7/0x370
[  916.746549][    C1]  ? __sanitizer_cov_trace_pc+0x32/0x60
[  916.746567][    C1]  ? default_do_nmi+0x62/0x150
[  916.746584][    C1]  ? exc_nmi+0xab/0x120
[  916.746598][    C1]  ? end_repeat_nmi+0x16/0x31
[  916.746620][    C1]  ? mpage_prepare_extent_to_map+0xcab/0x1150
[  916.746638][    C1]  ? mpage_prepare_extent_to_map+0xcb8/0x1150
[  916.746657][    C1]  ? __sanitizer_cov_trace_pc+0x32/0x60
[  916.746676][    C1]  ? __sanitizer_cov_trace_pc+0x32/0x60
[  916.746695][    C1]  ? __sanitizer_cov_trace_pc+0x32/0x60
[  916.746712][    C1]  </NMI>
[  916.746717][    C1]  <TASK>
[  916.746728][    C1]  mpage_prepare_extent_to_map+0xcb8/0x1150
[  916.746754][    C1]  ? trace_ext4_writepages+0x1e0/0x1e0
[  916.746780][    C1]  ? __ext4_journal_start_sb+0x175/0x370
[  916.746799][    C1]  ext4_writepages+0x1273/0x3d10
[  916.746838][    C1]  ? ext4_readpage+0x300/0x300
[  916.746859][    C1]  ? __kernel_text_address+0x94/0x100
[  916.746885][    C1]  ? __lock_acquire+0x1295/0x1ff0
[  916.746906][    C1]  ? ext4_readpage+0x300/0x300
[  916.746923][    C1]  do_writepages+0x481/0x730
[  916.747000][    C1]  ? __writepage+0x120/0x120
[  916.747015][    C1]  ? read_lock_is_recursive+0x10/0x10
[  916.747031][    C1]  ? filemap_fdatawrite_wbc+0x1cb/0x230
[  916.747049][    C1]  ? __lock_acquire+0x1ff0/0x1ff0
[  916.747063][    C1]  ? do_raw_spin_lock+0x14a/0x370
[  916.747084][    C1]  ? do_raw_spin_unlock+0x137/0x8b0
[  916.747101][    C1]  ? wbc_attach_and_unlock_inode+0x5e8/0x600
[  916.747123][    C1]  filemap_fdatawrite_wbc+0x1d6/0x230
[  916.747142][    C1]  filemap_flush+0x10c/0x150
[  916.747157][    C1]  ? ima_file_free+0x10f/0x3c0
[  916.747220][    C1]  ? filemap_fdatawrite_range+0x1b0/0x1b0
[  916.747246][    C1]  ? __mutex_unlock_slowpath+0x218/0x750
[  916.747265][    C1]  ? rcu_is_watching+0x11/0xa0
[  916.747282][    C1]  ext4_release_file+0x7d/0x300
[  916.747296][    C1]  ? ext4_file_open+0x710/0x710
[  916.747311][    C1]  __fput+0x3bf/0x890
[  916.747332][    C1]  task_work_run+0x129/0x1a0
[  916.747350][    C1]  do_exit+0x6a3/0x2480
[  916.747393][    C1]  ? put_task_struct+0x80/0x80
[  916.747412][    C1]  ? get_signal+0x8ac/0x14e0
[  916.747427][    C1]  do_group_exit+0x144/0x310
[  916.747443][    C1]  ? lockdep_hardirqs_on+0x94/0x130
[  916.747458][    C1]  get_signal+0xc66/0x14e0
[  916.747478][    C1]  arch_do_signal_or_restart+0xc3/0x1890
[  916.747499][    C1]  ? lockdep_hardirqs_on+0x94/0x130
[  916.747512][    C1]  ? _raw_spin_unlock_irqrestore+0xd9/0x130
[  916.747528][    C1]  ? _raw_spin_unlock+0x40/0x40
[  916.747545][    C1]  ? get_sigframe_size+0x10/0x10
[  916.747560][    C1]  ? force_sig_info_to_task+0x34a/0x470
[  916.747581][    C1]  ? force_sig+0x114/0x1d0
[  916.747598][    C1]  ? exit_to_user_mode_loop+0x39/0x130
[  916.747615][    C1]  exit_to_user_mode_loop+0x97/0x130
[  916.747629][    C1]  exit_to_user_mode_prepare+0xb1/0x140
[  916.747644][    C1]  irqentry_exit_to_user_mode+0x5/0x40
[  916.747659][    C1]  exc_general_protection+0x358/0x4f0
[  916.747673][    C1]  ? vtime_user_enter+0x1eb/0x2d0
[  916.747690][    C1]  ? __context_tracking_enter+0x5f/0x90
[  916.747711][    C1]  asm_exc_general_protection+0x22/0x30
[  916.747731][    C1] RIP: 0033:0x7fdf50972db1
[  916.747742][    C1] Code: Unable to access opcode bytes at RIP 0x7fdf50972d87.
[  916.747749][    C1] RSP: 002b:0000000020000130 EFLAGS: 00010217
[  916.747760][    C1] RAX: 0000000000000000 RBX: 00007fdf50aa1050 RCX: 00007fdf50972da9
[  916.747770][    C1] RDX: 0000000020000140 RSI: 0000000020000130 RDI: 0000000020000000
[  916.747780][    C1] RBP: 00007fdf509bf47a R08: 00000000200001c0 R09: 00000000200001c0
[  916.747790][    C1] R10: 0000000020000180 R11: 0000000000000206 R12: 0000000000000000
[  916.747799][    C1] R13: 000000000000006e R14: 00007fdf50aa1050 R15: 00007ffc29de5498
[  916.747816][    C1]  </TASK>
[  917.487585][T16038] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  917.500396][   T27] Kernel panic - not syncing: hung_task: blocked tasks
[  917.507258][   T27] CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.152-syzkaller #0
[  917.515242][   T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[  917.525316][   T27] Call Trace:
[  917.528596][   T27]  <TASK>
[  917.531528][   T27]  dump_stack_lvl+0x1e3/0x2cb
[  917.536229][   T27]  ? io_uring_drop_tctx_refs+0x19d/0x19d
[  917.541874][   T27]  ? panic+0x84d/0x84d
[  917.545990][   T27]  panic+0x318/0x84d
[  917.549899][   T27]  ? schedule_preempt_disabled+0x20/0x20
[  917.555541][   T27]  ? nmi_trigger_cpumask_backtrace+0x221/0x2a0
[  917.561722][   T27]  ? fb_is_primary_device+0xcc/0xcc
[  917.566947][   T27]  ? arch_trigger_cpumask_backtrace+0x10/0x10
[  917.573047][   T27]  ? nmi_trigger_cpumask_backtrace+0x221/0x2a0
[  917.579215][   T27]  ? nmi_trigger_cpumask_backtrace+0x281/0x2a0
[  917.585378][   T27]  ? nmi_trigger_cpumask_backtrace+0x286/0x2a0
[  917.591544][   T27]  watchdog+0xeb0/0xeb0
[  917.595727][   T27]  kthread+0x3f6/0x4f0
[  917.599920][   T27]  ? hungtask_pm_notify+0x50/0x50
[  917.604969][   T27]  ? kthread_blkcg+0xd0/0xd0
[  917.609574][   T27]  ret_from_fork+0x1f/0x30
[  917.614020][   T27]  </TASK>
[  917.617330][   T27] Kernel Offset: disabled
[  917.621659][   T27] Rebooting in 86400 seconds..