[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 18.614077] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 19.746218] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 19.951773] random: sshd: uninitialized urandom read (32 bytes read) [ 20.866864] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.26' (ECDSA) to the list of known hosts. [ 26.380645] random: sshd: uninitialized urandom read (32 bytes read) 2018/06/07 10:04:58 fuzzer started [ 27.644900] random: cc1: uninitialized urandom read (8 bytes read) 2018/06/07 10:05:01 dialing manager at 10.128.0.26:42109 [ 59.106205] can: request_module (can-proto-0) failed. [ 59.115205] can: request_module (can-proto-0) failed. 2018/06/07 10:05:33 kcov=true, comps=true [ 64.082560] random: crng init done 10:05:40 executing program 0: mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) ioctl$VT_RESIZE(r0, 0x400442c8, &(0x7f0000000000)) 10:05:40 executing program 2: r0 = open(&(0x7f00000001c0)='./bus\x00', 0x40, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r0, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000380)='/dev/snd/midiC#D#\x00', 0xe440, 0x1) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="2321202e2f6275730a994c3a99ac60c6f90034693e1ab0cfc4a6707b7e093ee8faca2ddb0a62ba4059676e67d2645a02f1194fa585c78df2954e2b5cbab0c45b9263315dfe2c3f62a9c986077c2703728c44b9420220ce7dd032005bc10915200ff5ed972027301a92a740454f362a9eb0fc3a210116c4185032cfb358dbe449f85363bd2a9b9307b9a855c6868b7674cba4fd34875d63266612716600e776a8131a4a1ab478e333b8623462b84c56fbbfaab04341d2c5f8977916cf841413cf"], 0xc0) write$cgroup_type(r1, &(0x7f00000000c0)='threaded\x00', 0xff4c) 10:05:40 executing program 7: r0 = gettid() exit(0x0) capget(&(0x7f0000000180)={0x19980330, r0}, &(0x7f0000000200)) 10:05:40 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000700)={0x26, 'skcipher\x00', 0x0, 0x0, 'rfc3686(ctr-serpent-avx)\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000100)=0x320, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5", 0x4) recvfrom$ipx(r1, &(0x7f0000000140)=""/220, 0xffffffffffffffbd, 0x0, 0x0, 0x3d1) 10:05:40 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0xf, 0x4, 0x0, 0x8}, 0x2c) 10:05:40 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x81) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000080)=0x1000) 10:05:40 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)="2f70726f632f7379732f6e65742f697076342f76732f73796e635f716c656e5f6d6178003292766f563c81606b55830efcf599356b06f30509d47a7ac0893296cb227d8056dd70422ae9ef7c2b1cb2527ffa3a65e8d2b1e9a7b886254e61adfec522ddb70069cac0de41431a7c48c237511be70225d84231ad85db2caa42cb26eb51f79d4941e5028aa1cbc10b2476747d43071c578ec0b21e78bacccfed6a5593b70fe613f118495ef67ad6429fea6beaafcce0e8a0b4081946c2d9dd88fcd65b480a47e2984fb670e13ddd4d3d3b8ff49580439bdb22a2322bdd90604b805f7493f60ebdbee56cb92dd8f3d548f7e9cb31d5b6ce2f111dff4bec7fcfb482cef71f3ecd174f1c6379b9c9f28ae5d531d6206cf3628165e30924d83dede3eb4d5bae9379442ba83d32a43a42", 0x2, 0x0) write(r1, &(0x7f0000002280)='-5', 0x2) 10:05:40 executing program 1: syz_mount_image$ntfs(&(0x7f0000000080)='ntfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000480)=[{&(0x7f00000003c0)="0e5374b52ff24ecb47906d4294602d2c6f8109a9e360428f2ba35c0315fab4a8d42ea8ecf45e787759db7ff282d6f2c9d1dffd2bf0bd49ef0c5d6c4aed4ae44133ccf6b81474444f4d2b", 0x4a, 0x7}], 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='show_sys_files']) [ 68.624097] IPVS: ftp: loaded support on port[0] = 21 [ 68.639447] IPVS: ftp: loaded support on port[0] = 21 [ 68.648926] IPVS: ftp: loaded support on port[0] = 21 [ 68.695064] IPVS: ftp: loaded support on port[0] = 21 [ 68.696189] IPVS: ftp: loaded support on port[0] = 21 [ 68.722901] IPVS: ftp: loaded support on port[0] = 21 [ 68.723616] IPVS: ftp: loaded support on port[0] = 21 [ 68.759724] IPVS: ftp: loaded support on port[0] = 21 [ 70.798919] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.805424] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.837589] device bridge_slave_0 entered promiscuous mode [ 70.864540] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.870923] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.895958] device bridge_slave_0 entered promiscuous mode [ 70.907924] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.914350] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.922374] device bridge_slave_0 entered promiscuous mode [ 70.929376] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.935743] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.944609] device bridge_slave_0 entered promiscuous mode [ 70.954431] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.960816] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.968711] device bridge_slave_0 entered promiscuous mode [ 70.977693] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.984084] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.991770] device bridge_slave_0 entered promiscuous mode [ 71.006498] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.012878] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.026221] device bridge_slave_1 entered promiscuous mode [ 71.034754] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.041137] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.049551] device bridge_slave_0 entered promiscuous mode [ 71.057923] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.064414] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.080917] device bridge_slave_0 entered promiscuous mode [ 71.091007] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.097408] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.108537] device bridge_slave_1 entered promiscuous mode [ 71.116766] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.123159] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.132362] device bridge_slave_1 entered promiscuous mode [ 71.141116] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.147559] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.165868] device bridge_slave_1 entered promiscuous mode [ 71.177582] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.184009] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.195395] device bridge_slave_1 entered promiscuous mode [ 71.203554] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.209923] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.223741] device bridge_slave_1 entered promiscuous mode [ 71.231664] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.238094] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.246278] device bridge_slave_1 entered promiscuous mode [ 71.254731] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 71.263734] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 71.273691] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.280058] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.305335] device bridge_slave_1 entered promiscuous mode [ 71.329721] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 71.337176] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 71.345661] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 71.366854] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 71.374253] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 71.383527] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 71.391505] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 71.433536] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 71.468139] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 71.477228] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 71.493986] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 71.503931] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 71.516416] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 71.543610] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 71.789651] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.806766] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.828486] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.883459] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.904145] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.918853] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.941129] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 71.957350] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.967041] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 71.977915] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 71.992930] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.053138] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.063880] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.087659] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.108378] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.123758] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 72.267685] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 72.275000] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.299602] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 72.308103] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 72.316082] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.329554] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.360820] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 72.369743] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.399781] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 72.414791] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 72.421908] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.437478] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.617091] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 72.635740] team0: Port device team_slave_0 added [ 72.693141] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 72.715516] team0: Port device team_slave_0 added [ 72.728440] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 72.743561] team0: Port device team_slave_0 added [ 72.761484] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 72.772991] team0: Port device team_slave_0 added [ 72.780998] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 72.789132] team0: Port device team_slave_1 added [ 72.796955] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 72.806589] team0: Port device team_slave_0 added [ 72.822468] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 72.834925] team0: Port device team_slave_1 added [ 72.840798] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 72.851242] team0: Port device team_slave_0 added [ 72.857174] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 72.865172] team0: Port device team_slave_0 added [ 72.874708] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 72.892985] team0: Port device team_slave_1 added [ 72.902077] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 72.914633] team0: Port device team_slave_0 added [ 72.922464] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 72.936706] team0: Port device team_slave_1 added [ 72.953916] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.972940] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 72.982611] team0: Port device team_slave_1 added [ 72.989973] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 73.005849] team0: Port device team_slave_1 added [ 73.019051] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 73.031706] team0: Port device team_slave_1 added [ 73.049182] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.066398] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.093209] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.111609] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 73.133757] team0: Port device team_slave_1 added [ 73.150673] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.170626] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.187994] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.201404] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.213885] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.225458] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.239919] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.250363] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 73.259390] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.267639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.284438] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 73.293403] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.322945] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.341434] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.352580] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.367805] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.377941] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 73.385893] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 73.394133] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.402331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.418644] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 73.432565] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.441720] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 73.450677] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 73.457719] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.472905] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.481311] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.489566] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.499496] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 73.508177] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 73.515855] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 73.524593] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 73.535563] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 73.544719] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 73.552080] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 73.559536] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.585877] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.620472] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 73.636660] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.648875] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.656591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.664387] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.672132] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.679797] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.687558] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.695295] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.702947] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.710691] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.718492] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.733719] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 73.742129] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.751764] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.761676] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 73.768916] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 73.776843] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 73.794964] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.813721] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.837415] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.854946] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.867060] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.874932] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.892257] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 73.911880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.937901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 75.007263] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.013764] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.020721] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.027086] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.043846] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 75.097699] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.104092] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.110750] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.117125] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.151357] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 75.163922] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.170302] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.176951] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.183332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.214718] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 75.223671] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.230058] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.236690] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.243061] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.254247] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 75.262147] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.268519] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.275166] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.281553] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.289114] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 75.302724] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.309106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.315748] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.322111] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.329789] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 75.336581] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.342930] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.349582] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.355945] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.365653] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 75.375411] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.381774] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.388411] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.394763] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.414687] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 75.433696] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.441401] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.456433] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.477879] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.485939] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.494319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.501637] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.508974] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 80.199984] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.221716] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.246640] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.271371] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.343052] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.368494] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.384797] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.415285] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.697312] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 80.709631] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 80.728869] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 80.744601] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 80.789706] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 80.809714] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 80.870068] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 80.876909] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 81.153455] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.159642] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.170625] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.190469] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.199088] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.216844] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.235855] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.244708] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.258171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.288601] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.310519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.329724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.339410] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.347910] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.356478] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.373249] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 81.382128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.392101] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.413651] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.433523] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.454220] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.468351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.475447] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.482438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.721644] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.744790] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.815065] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.833777] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.853143] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.867700] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.893421] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.907977] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.508043] ntfs: (device loop1): ntfs_fill_super(): Unable to determine device size. [ 84.580957] ntfs: (device loop1): ntfs_fill_super(): Unable to determine device size. 10:05:57 executing program 1: syz_mount_image$xfs(&(0x7f00000002c0)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2, &(0x7f0000000580)=[{&(0x7f0000000340)="4544d9e7f7ca6e21fbe14e98237b2a2dd5e6953bbfafb104db1cc45fcde4b42c17361f221db6726790e82293b1fdaef146827771068e016ae4aa7cd9cf349e7db1f82685806c1bcba7c1a4bd3362aa1b5933775d27ca6ef50dc4a0d713c663dabb552b1c7ed55d20235825064ad1498ce2fb", 0x72, 0x40}, {&(0x7f0000000540), 0x0, 0xffffffffffffffc3}], 0x0, &(0x7f0000000600)={'nouuid,'}) 10:05:57 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0xf, 0x4, 0x0, 0x8}, 0x2c) 10:05:57 executing program 2: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x4}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x2a, &(0x7f0000000080)=0x2, 0x4) 10:05:57 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0xf503}, 0xc, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0x27, 0x3, 0x0, 0x0, {0x11}}, 0x14}, 0x1}, 0x0) [ 84.944258] XFS (loop1): Invalid superblock magic number [ 85.004976] XFS (loop1): Invalid superblock magic number [ 85.260552] capability: warning: `syz-executor7' uses 32-bit capabilities (legacy support in use) 10:05:57 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[0xfeffffff], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r2 = socket(0x11, 0x100000803, 0x0) r3 = syz_open_dev$tun(&(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={"6966623000faffffffffffffff00", 0x12}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@dev={0xfe, 0x80}}, 0x31) 10:05:57 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x40) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r1, &(0x7f000087dffe)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}}, 0x0, 0x0, 0x8000, 0x0, 0x10}, 0x98) 10:05:57 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl=@kern={0x10}, 0x80, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5300fe01b2a4a280930a06000000a8430891000000390008000a000a00060000001900a30700000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab91d4", 0x55}], 0x1, &(0x7f0000000400)}, 0x0) 10:05:57 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0xf, 0x4, 0x0, 0x8}, 0x2c) 10:05:57 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x1c) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000000340)=""/20, &(0x7f0000000380)=0x14) 10:05:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0247e22f05d02c99240970") openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000280)=""/11, 0xb6) 10:05:57 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, "706f72ff070000000000000000000000000b000000000000000000001f0000ffffff03000000ef000003ff02000000000012000000000000000000000600", 0xc7}) r1 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000100)={{}, {0x80}}) 10:05:57 executing program 1: syz_mount_image$xfs(&(0x7f00000002c0)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2, &(0x7f0000000580)=[{&(0x7f0000000340)="4544d9e7f7ca6e21fbe14e98237b2a2dd5e6953bbfafb104db1cc45fcde4b42c17361f221db6726790e82293b1fdaef146827771068e016ae4aa7cd9cf349e7db1f82685806c1bcba7c1a4bd3362aa1b5933775d27ca6ef50dc4a0d713c663dabb552b1c7ed55d20235825064ad1498ce2fb", 0x72, 0x40}, {&(0x7f0000000540), 0x0, 0xffffffffffffffc3}], 0x0, &(0x7f0000000600)={'nouuid,'}) 10:05:58 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0xf, 0x4, 0x0, 0x8}, 0x2c) 10:05:58 executing program 5: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00002e9000)='task\x00') getdents(r0, &(0x7f0000720fd4)=""/44, 0x1b3) [ 85.555209] XFS (loop1): Invalid superblock magic number 10:05:58 executing program 2: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00005dafe4)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000640)="d6a20b64742dba78b4225d41f0fd331d853b17f6c3d9e888ae55633c258064f12b27a870ab2d106a05cbd05b06ccd5", 0x2f}], 0x1}, 0x0) open(&(0x7f0000000640)="2e2f66696c65302f662e6c6530f0", 0x40003ffe, 0x0) 10:05:58 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, "706f72ff070000000000000000000000000b000000000000000000001f0000ffffff03000000ef000003ff02000000000012000000000000000000000600", 0xc7}) r1 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000100)={{}, {0x80}}) 10:05:58 executing program 1: syz_mount_image$xfs(&(0x7f00000002c0)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2, &(0x7f0000000580)=[{&(0x7f0000000340)="4544d9e7f7ca6e21fbe14e98237b2a2dd5e6953bbfafb104db1cc45fcde4b42c17361f221db6726790e82293b1fdaef146827771068e016ae4aa7cd9cf349e7db1f82685806c1bcba7c1a4bd3362aa1b5933775d27ca6ef50dc4a0d713c663dabb552b1c7ed55d20235825064ad1498ce2fb", 0x72, 0x40}, {&(0x7f0000000540), 0x0, 0xffffffffffffffc3}], 0x0, &(0x7f0000000600)={'nouuid,'}) 10:05:58 executing program 4: symlink(&(0x7f0000000180)='/\x00', &(0x7f0000000140)='./file0\x00') syz_mount_image$ext4(&(0x7f0000000080)="e5700600", &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f00000014c0), 0x10a036, &(0x7f00000000c0)={[{@min_batch_time={'min_batch_time', 0x3d, [0x30]}, 0x2c}]}) 10:05:58 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0247e22f05d02c99240970") openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000280)=""/11, 0xb6) 10:05:58 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp6\x00') bind$alg(r0, &(0x7f0000001100)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-generic\x00'}, 0x58) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendfile(r2, r1, &(0x7f000025d000), 0x734) 10:05:58 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x40) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r1, &(0x7f000087dffe)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}}, 0x0, 0x0, 0x8000, 0x0, 0x10}, 0x98) 10:05:58 executing program 5: r0 = getpgid(0x0) sched_setaffinity(r0, 0x1cd, &(0x7f0000da3000)=0x2) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d137e637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0xc3, @time}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5334, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f00000001c0)={0x0, @time}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) 10:05:58 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0054fc2f07d82c99240970") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x0, &(0x7f0000000080)) ioctl$sock_bt_hci(r1, 0x800448d4, &(0x7f00000011c0)) 10:05:58 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, "706f72ff070000000000000000000000000b000000000000000000001f0000ffffff03000000ef000003ff02000000000012000000000000000000000600", 0xc7}) r1 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000100)={{}, {0x80}}) [ 86.013432] EXT4-fs (sda1): re-mounted. Opts: min_batch_time=0, 10:05:58 executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000000)={'raw\x00', 0x2, [{}, {}]}, 0x48) 10:05:58 executing program 2: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00005dafe4)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000640)="d6a20b64742dba78b4225d41f0fd331d853b17f6c3d9e888ae55633c258064f12b27a870ab2d106a05cbd05b06ccd5", 0x2f}], 0x1}, 0x0) open(&(0x7f0000000640)="2e2f66696c65302f662e6c6530f0", 0x40003ffe, 0x0) [ 86.075968] XFS (loop1): Invalid superblock magic number 10:05:58 executing program 1: syz_mount_image$xfs(&(0x7f00000002c0)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2, &(0x7f0000000580)=[{&(0x7f0000000340)="4544d9e7f7ca6e21fbe14e98237b2a2dd5e6953bbfafb104db1cc45fcde4b42c17361f221db6726790e82293b1fdaef146827771068e016ae4aa7cd9cf349e7db1f82685806c1bcba7c1a4bd3362aa1b5933775d27ca6ef50dc4a0d713c663dabb552b1c7ed55d20235825064ad1498ce2fb", 0x72, 0x40}, {&(0x7f0000000540), 0x0, 0xffffffffffffffc3}], 0x0, &(0x7f0000000600)={'nouuid,'}) 10:05:58 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x40) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r1, &(0x7f000087dffe)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}}, 0x0, 0x0, 0x8000, 0x0, 0x10}, 0x98) 10:05:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x800000008912, &(0x7f0000000500)="0047fc2f07d82c99240970") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x5, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1163484001"], 0x0, 0x0, &(0x7f0000000080)}) [ 86.389146] XFS (loop1): Invalid superblock magic number [ 86.505079] binder: release 6811:6815 transaction 2 out, still active [ 86.511861] binder: unexpected work type, 4, not freed [ 86.517253] binder: undelivered TRANSACTION_COMPLETE [ 86.523288] binder: 6811:6815 transaction failed 29189/-22, size 0-0 line 2852 [ 86.533268] binder_alloc: binder_alloc_mmap_handler: 6811 20001000-20004000 already mapped failed -16 [ 86.546077] binder: BINDER_SET_CONTEXT_MGR already set [ 86.552490] binder: 6811:6815 ioctl 40046207 0 returned -16 [ 86.560698] binder_alloc: 6811: binder_alloc_buf, no vma [ 86.566447] binder: 6811:6818 transaction failed 29189/-3, size 24-8 line 2967 [ 86.576097] binder: 6811:6817 got transaction to invalid handle [ 86.582346] binder: 6811:6817 transaction failed 29201/-22, size 0-0 line 2852 [ 86.589225] binder: undelivered TRANSACTION_ERROR: 29189 [ 86.607202] binder: undelivered TRANSACTION_ERROR: 29201 [ 86.612728] binder: undelivered TRANSACTION_ERROR: 29189 [ 86.618277] binder: send failed reply for transaction 2, target dead 10:05:59 executing program 4: unshare(0x8020000) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") semget$private(0x0, 0x4007, 0x0) shmget(0xffffffffffffffff, 0x1000, 0x0, &(0x7f0000ffc000/0x1000)=nil) unshare(0x8000200) 10:05:59 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, "706f72ff070000000000000000000000000b000000000000000000001f0000ffffff03000000ef000003ff02000000000012000000000000000000000600", 0xc7}) r1 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000100)={{}, {0x80}}) 10:05:59 executing program 2: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00005dafe4)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000640)="d6a20b64742dba78b4225d41f0fd331d853b17f6c3d9e888ae55633c258064f12b27a870ab2d106a05cbd05b06ccd5", 0x2f}], 0x1}, 0x0) open(&(0x7f0000000640)="2e2f66696c65302f662e6c6530f0", 0x40003ffe, 0x0) 10:05:59 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x40) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r1, &(0x7f000087dffe)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}}, 0x0, 0x0, 0x8000, 0x0, 0x10}, 0x98) 10:05:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0247e22f05d02c99240970") openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000280)=""/11, 0xb6) 10:05:59 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") sendmmsg(r0, &(0x7f0000004840)=[{{&(0x7f0000000100)=@l2={0x1f}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000240)="b0", 0x1}], 0x1, &(0x7f0000000640)}}, {{&(0x7f0000000740)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev={0xfe, 0x80}}}}, 0x80, &(0x7f0000003a80)=[{&(0x7f0000000a00)='j', 0x1}], 0x1, &(0x7f0000003b00)}}, {{&(0x7f00000042c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x80, &(0x7f0000004400)=[{&(0x7f0000004340)="c4", 0x1}], 0x1}}, {{&(0x7f0000004440)=@sco={0x1f}, 0x80, &(0x7f0000004580)=[{&(0x7f00000044c0)="87", 0x1}], 0x1, &(0x7f00000045c0)=[{0x28, 0x0, 0x0, "9f7a98f7fb046e311ef63d81c82f81eda4"}], 0x28}}], 0x4, 0x8000) 10:05:59 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000003c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)=@setlink={0x28, 0x13, 0x709, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_IF_NETNSID={0x8, 0x2e}]}, 0x28}, 0x1}, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x0, @broadcast=0xffffffff}}}, &(0x7f00000000c0)=0x84) 10:05:59 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0xa, 0x0, 0x4, 0x2}, 0x10}, 0x1}, 0x0) 10:05:59 executing program 2: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00005dafe4)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000640)="d6a20b64742dba78b4225d41f0fd331d853b17f6c3d9e888ae55633c258064f12b27a870ab2d106a05cbd05b06ccd5", 0x2f}], 0x1}, 0x0) open(&(0x7f0000000640)="2e2f66696c65302f662e6c6530f0", 0x40003ffe, 0x0) 10:05:59 executing program 5: r0 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x10d, 0xb, &(0x7f0000000040), 0xc) 10:05:59 executing program 4: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0042fc2f07d82c99240970") syz_emit_ethernet(0x66, &(0x7f0000000140)={@empty=[0x2b], @random="1b207f5c5eeb", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, @local={0xac, 0x14, 0x14, 0xaa}}, @gre={{0x0, 0x0, 0x1, 0x0, 0xb, 0xfeffffff, 0x0, 0x6, 0x880b}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd}, {0x8, 0x57, 0x0, {{0x0, 0x1}, 0x1}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2}, 0x2}}, {0x8, 0x6558}}}}}}, &(0x7f0000000000)) 10:05:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000100)="66b91000004066b80000000066ba000000000f30baa000eddb8f05000f89ae6a660f3a22efa80f09f00fc709f20f1ab60d0066b93608000066b80000000066ba008000000f3066b9800000c00f326635000800000f30", 0x56}], 0x1, 0x0, &(0x7f00000000c0), 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 10:05:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x401, 0x10800) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000280)={{{@in=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000040)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000080)={@remote={0xfe, 0x80, [], 0xbb}, r2}, 0x14) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000440)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f00000001c0)=[@fd={0x66642a85}], &(0x7f0000000200)=[0x78]}}], 0x0, 0x0, &(0x7f0000000180)}) 10:05:59 executing program 0: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$fuse(r0, &(0x7f000000afdf)={0x18, 0x1, 0x0, @fuse_bmap_out}, 0x18) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f0000000080)={0x3, 0x9}) 10:05:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0247e22f05d02c99240970") openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net\x00\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000280)=""/11, 0xb6) 10:06:00 executing program 0: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, &(0x7f0000000140)={0x56, &(0x7f0000000000)=""/86}) r4 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r4, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"410f44be5f55ea719cbb6635"}}], 0x30) syz_mount_image$cifs(&(0x7f00000000c0)='cifs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000480), 0xa840, &(0x7f0000000500)='\x00') fchmod(r4, 0x0) dup2(r1, r3) [ 87.572250] binder: 6874:6879 got transaction to context manager from process owning it [ 87.580499] binder: 6874:6879 transaction failed 29201/-22, size 24-8 line 2843 [ 87.603545] binder: BINDER_SET_CONTEXT_MGR already set [ 87.609442] binder: 6874:6882 ioctl 40046207 0 returned -16 10:06:00 executing program 4: r0 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) fcntl$setlease(r0, 0x400, 0x1) [ 87.635490] binder: undelivered TRANSACTION_ERROR: 29201 10:06:01 executing program 5: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, &(0x7f0000000140)={0x56, &(0x7f0000000000)=""/86}) r4 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r4, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"410f44be5f55ea719cbb6635"}}], 0x30) syz_mount_image$cifs(&(0x7f00000000c0)='cifs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000480), 0xa840, &(0x7f0000000500)='\x00') fchmod(r4, 0x0) dup2(r1, r3) 10:06:01 executing program 0: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$DRM_IOCTL_GET_UNIQUE(r2, 0xc0106401, &(0x7f0000000140)={0x56, &(0x7f0000000000)=""/86}) r4 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r4, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"410f44be5f55ea719cbb6635"}}], 0x30) syz_mount_image$cifs(&(0x7f00000000c0)='cifs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000480), 0xa840, &(0x7f0000000500)='\x00') fchmod(r4, 0x0) dup2(r1, r3) 10:06:01 executing program 4: r0 = socket$inet6(0xa, 0x803, 0xfffffffffffffffc) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000000)) getsockopt$inet6_int(r0, 0x29, 0xce, &(0x7f0000f61ffc), &(0x7f0000001ffc)=0xfffffffffffffe03) munlockall() 10:06:01 executing program 4: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x10) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r0}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x14, &(0x7f00000000c0), 0x1b3) connect$unix(r0, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e21}, 0x6e) 10:06:01 executing program 4: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x10) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r0}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x14, &(0x7f00000000c0), 0x1b3) connect$unix(r0, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e21}, 0x6e) 10:06:01 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="1bd45006000000d1240970") r1 = socket(0x2, 0x3, 0x40000000000000ff) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2040, 0x0) unlinkat(r2, &(0x7f0000000040)='./file0\x00', 0x0) sendto$inet(r1, &(0x7f0000000140)="2063ae8f80db1f9c0dec203223df75310bc2e86d", 0x14, 0x0, &(0x7f0000000180)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) 10:06:01 executing program 4: capset(&(0x7f0000002ffa)={0x20080522}, &(0x7f0000002000)) r0 = socket(0x10, 0x802, 0x0) fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r1, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0xc0082, 0x0) ioctl$KDDISABIO(r2, 0x4b37) 10:06:01 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x288200, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000540)={'TPROXY\x00'}, &(0x7f0000000580)=0x1e) mount(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='configfs\x00', 0x0, &(0x7f0000000180)) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a85322, &(0x7f00000000c0)) lseek(r1, 0x0, 0x1) ioctl$SIOCGIFMTU(r1, 0x8921, &(0x7f0000000180)) 10:06:01 executing program 4: r0 = memfd_create(&(0x7f0000000100)="885d292b00", 0x0) write(r0, &(0x7f0000000080)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000000040), 0xff8) rename(&(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='./file0\x00') fadvise64(r0, 0x0, 0x3ff, 0x7) 10:06:01 executing program 4: r0 = memfd_create(&(0x7f0000000100)="885d292b00", 0x0) write(r0, &(0x7f0000000080)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000000040), 0xff8) rename(&(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='./file0\x00') fadvise64(r0, 0x0, 0x3ff, 0x7) 10:06:01 executing program 4: r0 = memfd_create(&(0x7f0000000100)="885d292b00", 0x0) write(r0, &(0x7f0000000080)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000000040), 0xff8) rename(&(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='./file0\x00') fadvise64(r0, 0x0, 0x3ff, 0x7) 10:06:02 executing program 4: r0 = memfd_create(&(0x7f0000000100)="885d292b00", 0x0) write(r0, &(0x7f0000000080)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000000040), 0xff8) rename(&(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='./file0\x00') fadvise64(r0, 0x0, 0x3ff, 0x7) 10:06:02 executing program 0: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x813) 10:06:02 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000080)=0x9) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000100)='./file0\x00', 0xffffffff, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c0b4a40200010000100000000000000000000000000c0908040c", 0x7d}], 0x0, &(0x7f00000001c0)) [ 89.678990] XFS (loop5): Mounting V4 Filesystem [ 89.699156] XFS (loop5): totally zeroed log [ 89.710724] XFS (loop5): Metadata corruption detected at xfs_agi_verify+0x187/0x4f0, xfs_agi block 0x2 [ 89.720507] XFS (loop5): Unmount and run xfs_repair [ 89.725571] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 89.732267] 000000005e069617: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 89.741145] 00000000b96dcef3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 89.750055] 000000006bfd561f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 89.758922] 0000000046e62fcd: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 89.767841] 000000002f2a1d32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 89.776771] 00000000906036c4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 89.785653] 0000000013fc7fce: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10:06:02 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='^GPL{vmnet1#\x00', 0x0) fsetxattr(r0, &(0x7f0000000180)=@known='security.ima\x00', &(0x7f0000000380)="002fb4e5878d1bbd7a33882e0147df80e95b1e3b80c03149893834fd8a776a0fcb31037ec38d83a720b085a51275653f57770dd38336c7b5c6e9087388f5b68b363032ecb8166958f83e2d0979", 0x4d, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000000)=0x3fff8000000, 0x4) fgetxattr(r0, &(0x7f0000000080)=@known='security.ima\x00', &(0x7f0000000140)=""/5, 0xffffffffffffffa1) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') getsockname$packet(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000200)=0x14) getsockname$packet(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000280)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000400)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@local}}, &(0x7f0000000340)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000500)={'teql0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000540)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f0000000640)=0xe8) recvmsg(r0, &(0x7f00000008c0)={&(0x7f0000000680)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000700)=""/180, 0xb4}, {&(0x7f00000007c0)=""/42, 0x2a}], 0x2, &(0x7f0000000840)=""/102, 0x66}, 0x2100) getsockname(r0, &(0x7f0000000900)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000980)=0x80) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000009c0)={'irlan0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000d00)={{{@in=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000000e00)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000e40)={'team0\x00', 0x0}) mknod(&(0x7f0000000300)='./file0\x00', 0x7004, 0xd387) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f00000011c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000001180)={&(0x7f0000000e80)={0x2f0, r1, 0x302, 0x70bd28, 0x25dfdbfb, {0x1}, [{{0x8, 0x1, r2}, {0xb4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x34}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r3}}, {0x8, 0x7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0xbc, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xfffffffffffffffa}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x14, 0x4, 'activebackup\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r7}, {0x7c, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r9}}}]}}, {{0x8, 0x1, r10}, {0xd0, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x123}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0x2f0}, 0x1, 0x0, 0x0, 0x80}, 0x4000800) getsockopt$inet_buf(r0, 0x0, 0x3f, &(0x7f0000000a00)=""/177, &(0x7f00000002c0)=0xb1) 10:06:02 executing program 4: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:02 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x102, 0x0) getsockopt$llc_int(r0, 0x10c, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x4) syz_init_net_socket$llc(0x1a, 0x2, 0x0) [ 89.794516] 00000000d2df2d20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 89.805374] XFS (loop5): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x2 len 1 error 117 [ 89.815122] XFS (loop5): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -117, agno 0 [ 89.823946] XFS (loop5): failed to read root inode 10:06:02 executing program 7: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)) 10:06:02 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x1, 0x10, 0x5, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r0, &(0x7f0000000000), &(0x7f0000000080)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r0, &(0x7f00000003c0)="860cc5a6", &(0x7f0000000540)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r0, &(0x7f0000000040)='`', &(0x7f0000000540)=""/4096}, 0x18) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0, &(0x7f0000000540)}, 0x10) 10:06:02 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) close(r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-des3_ede-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000001f3a)="ad56b6c5820faeb995298992ea54c7beef9f5d56534c90c2", 0x18) r2 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000200)=[{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)="502da457d6d9e3097bdc90ddf3247273e876b18d6f21768bfc170b27166eaf3f0bc8fdd0cacef007a17678c0143294b50c7bfa14b51945b044dd9fbd00f3d4e31c5146268b602264e7cd4ee09ad42026bf3c24b06cc8f986", 0x58}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) recvmsg(r2, &(0x7f00000007c0)={&(0x7f00000005c0)=@ipx, 0x80, &(0x7f0000000780)=[{&(0x7f0000000640)=""/26, 0x1a}, {&(0x7f0000000680)=""/137, 0x89}], 0x2}, 0x0) 10:06:02 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x202) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970") ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f00000000c0)={'bridge0\x00', @ifru_settings={0x0, 0x0, @fr_pvc=&(0x7f0000000080)}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[], 0x0, 0x1a200}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0x3) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0x40405515, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, "7914084b165e9ec52f1595ab29ebf015f37b541a5750acb2ac95e9ad3962af352e5323b779821fa55ee14bf9"}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000240)='/dev/uinput\x00', 0x0, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000000)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:02 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300), 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007400)=[{{&(0x7f0000001840)=@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x80, &(0x7f0000001ac0), 0x0, &(0x7f0000001b00)}}, {{&(0x7f0000001d00)=@hci={0x1f}, 0x80, &(0x7f0000001e80), 0x0, &(0x7f0000001ec0)=[{0x10, 0x117, 0x4}], 0x10}}], 0x2, 0x0) 10:06:02 executing program 0: r0 = perf_event_open(&(0x7f00000000c0)={0x8, 0x70, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, r0, 0x0) 10:06:02 executing program 6: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xa, 0x6b, 0x3ff, 0x7f}, 0x2c) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) 10:06:02 executing program 5: r0 = socket(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond_slave_0\x00', &(0x7f0000000000)=@ethtool_gstrings={0x1b, 0x5}}) 10:06:02 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000100)="240000000a0a07041dfffd946fa2830020200a0009000100021d85680c1baba20400ff7e28000000110affffba16a0aa1c0009b356da5a80d18bec4c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 10:06:02 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'veth1_to_bond\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000080)={0x1d, r1}, 0x10) 10:06:02 executing program 7: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c1c240970") r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) syz_emit_ethernet(0x437, &(0x7f0000000700)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x401, 0x11, 0x0, @dev={0xfe, 0x80}, @local={0xfe, 0x80, [], 0xaa}, {[], @dccp={{0x0, 0x4e20, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}, "2b00b32def4f1142b6793bb530f9b20e90aa25d5c2b9431efd840a07c1922833b2c789aefbbaee9f63cbab38a8acfb8dba0595ecb683e74ea2bc44a7aee9c52e18ca01c06a5c354712b8b1ff75f45ba55a3487c83849023d37e037d2d3e3e842e9ba099e9ed8775d1173d8e78335aa65d58f54c1d78d4fce897cfefa24b7f268f90be76c7f4e1bfe4d84a869353e931c3732afea55697618a1318ecb657b34172b93fd59d7988d43630cf81e976a0ea01fd8b2547ab593bc605c985f56664b84ed3c9f90ffb666e030c794e2d2d5070af38d83dc275da88cfe6910b2ded59f6c418af5d247237eceb14857c1d7c3ee32e729d9793040f8f4e432eb875a89fe31cbed117f0e76643797169fba3dac3f377d145ce97980ba626da7a279e698a9e040a22d63c535f0ee06adb59e9e06ad7295e6601f3a5fe9b581975993c6c775734212bccb26288d42a672c965d40e80d0e1908f04425a60a08241378ec7ff88315de073b64c5f9647e51732be34988e0948f12e6c560bedbece811bca501d4389dbfe20e4df5160cd7324c0670c7b3e8980b061e31b1c8461d6f7a63f9e9fd24326924c076e01631a0b9703a6106accfaa064075fa1f16e16c5171b6a324e8642b2ab76618b824110c312ab12d9f65d6a980634a6a7cba8bf89e01a91259f446232476a1c490982636b78d1300befab1a2f6e8261e07336c5692db37bb7d3cebf4a942b62f2fa6cceb7e488aa02b2e52c6f82bd3792845fff41cce52e0469d14821ce11491864860c11421a92dae3152eb23106a0c679d2b1f0a9809b56abdcf893f9531508f24e64ec911fd8e8b3c8fd2291f1a7b910222c38533d4caadac9acd194be7e53549c1719bdf668887a0e19db83b5356f8f7d93cbef1ef3505dcc40d0d2a02a2745ab518979b9c3774babfe8e70ead767c7a00289b8cc6e51d1a957548270cb3f5064961a88f61b34f9442d78ae5a8551713f9afb4269d689f9adb6b4a902a637184f7f899efe9fa0ddb45cd1076c4eeeda51ca8dc20dcfc9cc5f56768073b3f4c2c9f543324a4fd0b8bc7b95e232bf85bf222394fa4336ab4007d7ad2dc85afa6eb79ad2624c4be6c674ee98fce9a51786b7cc2b5044de114d36d2690e13bcedf96590c7d5aeb8040b74c4d6a5aa38a7c1f0857522f4f968795056b9a7034dc3444784f9486b575e44dec3216d72845500e63297d7197961e7e593ea3411001d1d47ba42d70e7af8e91246c02d7e37ff0eb60abebc37dd00315b4fbb09e77a6b5f7e8441818ebcfafecf622731f1db8a11fa2de8e30d808bedbfee104b3b1100f5094675521da07dd2a28be7e486b325a0f0e6d75116be1bbc2aa20deb64a6e4e7b824b12d009e6f1802f5a8e31559b125d71d00a5684fbde4668f5af1eb4ca04fa7c4ef4d2a194b0856e007"}}}}}}, &(0x7f0000001780)) recvfrom(r1, &(0x7f00000000c0)=""/251, 0x3f9, 0x0, &(0x7f0000000000)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "8df0d47434cdbcd50af760189e41d163f0fc8a3fcd8091d7e462359ba12143866e68a9028c2ccc7c1fc5ae13c3f188e2e7d7b8b4d32be094067b9571df0821"}, 0x709000) sendto$inet6(r1, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) [ 90.057201] *** Guest State *** [ 90.060793] CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7 [ 90.069710] CR4: actual=0x0000000000002040, shadow=0x0000000000000000, gh_mask=ffffffffffffe871 [ 90.078707] CR3 = 0x0000000000000000 [ 90.082503] RSP = 0x0000000000000000 RIP = 0x0000000000000000 [ 90.088494] RFLAGS=0x0001a202 DR7 = 0x0000000000000400 [ 90.094491] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 [ 90.101189] CS: sel=0xf000, attr=0x0009b, limit=0x0000ffff, base=0x00000000ffff0000 [ 90.109188] DS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 90.117173] SS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 90.125160] ES: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 90.133148] FS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 90.141142] GS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 90.149143] GDTR: limit=0x0000ffff, base=0x0000000000000000 [ 90.157138] LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000 [ 90.165123] IDTR: limit=0x0000ffff, base=0x0000000000000000 [ 90.173113] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 90.181106] EFER = 0x0000000000000000 PAT = 0x0007040600070406 [ 90.187534] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 90.195000] Interruptibility = 00000000 ActivityState = 00000000 [ 90.201271] *** Host State *** [ 90.204479] RIP = 0xffffffff811f741c RSP = 0xffff8801ad947390 [ 90.210487] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 90.216930] FSBase=00007f7550aa1700 GSBase=ffff8801dae00000 TRBase=fffffe0000003000 [ 90.224734] GDTBase=fffffe0000001000 IDTBase=fffffe0000000000 [ 90.230631] CR0=0000000080050033 CR3=00000001acefa000 CR4=00000000001426f0 [ 90.237655] Sysenter RSP=fffffe0000002200 CS:RIP=0010:ffffffff87801380 [ 90.244331] EFER = 0x0000000000000d01 PAT = 0x0000000000000000 [ 90.250407] *** Control State *** [ 90.253870] PinBased=0000003f CPUBased=b5a06dfa SecondaryExec=000000c3 [ 90.260541] EntryControls=0000d1ff ExitControls=0023efff [ 90.266035] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 90.272977] VMEntry: intr_info=8000009e errcode=00000000 ilen=00000000 [ 90.279652] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 90.286238] reason=80000021 qualification=0000000000000000 [ 90.292563] IDTVectoring: info=00000000 errcode=00000000 [ 90.298042] TSC Offset = 0xffffffcd3bae2035 [ 90.302380] TPR Threshold = 0x00 10:06:02 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = semget$private(0x0, 0x2, 0x0) semctl$SEM_INFO(r0, 0x0, 0x13, &(0x7f0000000080)=""/1) readv(0xffffffffffffffff, &(0x7f0000000000), 0x0) [ 90.305749] EPT pointer = 0x00000001c2e5801e 10:06:03 executing program 5: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb034d564b0000000001"]) ioctl$KVM_X86_SET_MCE(r3, 0xc008ae88, &(0x7f0000000140)={0x2, 0xda0}) [ 90.583897] netlink: 20 bytes leftover after parsing attributes in process `syz-executor1'. [ 91.382358] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 10:06:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7f, 0x0, 0x4}) 10:06:03 executing program 0: r0 = perf_event_open(&(0x7f00000000c0)={0x8, 0x70, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, r0, 0x0) 10:06:03 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000adafa0), 0x8) getsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000325f23)=""/221, &(0x7f0000108000)=0xdd) 10:06:03 executing program 6: r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000140), 0x7) 10:06:03 executing program 2: r0 = timerfd_create(0x0, 0x0) readv(r0, &(0x7f0000000440)=[{&(0x7f0000000400)=""/44, 0x3b3}], 0x1) timerfd_settime(r0, 0x3, &(0x7f0000000100)={{0x0, 0x989680}}, &(0x7f00000003c0)) clock_gettime(0x0, &(0x7f0000000040)={0x0}) clock_settime(0x0, &(0x7f0000000240)={r1}) 10:06:03 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000f85000)={0x2, 0x1, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}}]}, 0x60}, 0x1}, 0x0) getpeername$netlink(r0, &(0x7f0000000140), &(0x7f0000000180)=0xc) syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0) ioctl(r0, 0xffff, &(0x7f0000000000)="d7264e59716a4b069b781e5d4016c981c58defb42fafa657d78048e2bc564c19f63c1a2179ffb7b3bf82ca5a72a2887430db50faee8a024fdcbf651443b253bebcc45c4b375dec01f6539dfa3ffd2a12a390ca1d1fa0838210bf82f9f80262b2616e7fcc835b7be4beb91546c529beefb5c7183150c2bd2a6477bac5ae38f7405b8d398e2f2bf402876777b9854899b91a0906ae45ca7d0f508ef4ac1b") 10:06:03 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 10:06:03 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x200000000002, 0xc) write(r0, &(0x7f0000390000)="1f0000000107fd02010c00f60000ff008109f80009000180060109ec000000", 0x1f) 10:06:04 executing program 6: unshare(0x400) r0 = socket$inet(0x2, 0x3, 0x2) r1 = socket(0xa, 0x1, 0x0) ioctl(r1, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") getsockopt(r0, 0x0, 0xcf, &(0x7f00000002c0)=""/203, &(0x7f0000000040)=0xcb) 10:06:04 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000f85000)={0x2, 0x1, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}}]}, 0x60}, 0x1}, 0x0) getpeername$netlink(r0, &(0x7f0000000140), &(0x7f0000000180)=0xc) syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0) ioctl(r0, 0xffff, &(0x7f0000000000)="d7264e59716a4b069b781e5d4016c981c58defb42fafa657d78048e2bc564c19f63c1a2179ffb7b3bf82ca5a72a2887430db50faee8a024fdcbf651443b253bebcc45c4b375dec01f6539dfa3ffd2a12a390ca1d1fa0838210bf82f9f80262b2616e7fcc835b7be4beb91546c529beefb5c7183150c2bd2a6477bac5ae38f7405b8d398e2f2bf402876777b9854899b91a0906ae45ca7d0f508ef4ac1b") 10:06:04 executing program 0: r0 = perf_event_open(&(0x7f00000000c0)={0x8, 0x70, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, r0, 0x0) 10:06:04 executing program 1: r0 = socket$inet6(0xa, 0x2000000802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote={0xfe, 0x80, [], 0xbb}, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f000089b000)=0x1, 0x4) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000000100)=@in6={0xa, 0x4e24, 0x800, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000200)=[{0x18, 0x29, 0x4, "f1"}], 0x18}, 0x0) 10:06:04 executing program 4: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x1) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000140)='/dev/rfkill\x00') mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) 10:06:04 executing program 6: perf_event_open(&(0x7f0000000180)={0x800000000002, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x3) memfd_create(&(0x7f0000000040)='%\x00', 0x80004000005) 10:06:04 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000000100)) bind$can_raw(r0, &(0x7f0000001640)={0x1d, r1}, 0x10) bind$can_raw(r0, &(0x7f0000000000)={0x1d}, 0x10) [ 91.677650] binder: BINDER_SET_CONTEXT_MGR already set [ 91.686994] binder: 7066:7071 ioctl 40046207 0 returned -16 10:06:04 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000000), 0x4) [ 91.731582] binder: release 7066:7069 transaction 11 out, still active [ 91.738429] binder: unexpected work type, 4, not freed [ 91.743761] binder: undelivered TRANSACTION_COMPLETE [ 91.749746] binder: send failed reply for transaction 11, target dead 10:06:04 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000f85000)={0x2, 0x1, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}}]}, 0x60}, 0x1}, 0x0) getpeername$netlink(r0, &(0x7f0000000140), &(0x7f0000000180)=0xc) syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0) ioctl(r0, 0xffff, &(0x7f0000000000)="d7264e59716a4b069b781e5d4016c981c58defb42fafa657d78048e2bc564c19f63c1a2179ffb7b3bf82ca5a72a2887430db50faee8a024fdcbf651443b253bebcc45c4b375dec01f6539dfa3ffd2a12a390ca1d1fa0838210bf82f9f80262b2616e7fcc835b7be4beb91546c529beefb5c7183150c2bd2a6477bac5ae38f7405b8d398e2f2bf402876777b9854899b91a0906ae45ca7d0f508ef4ac1b") 10:06:04 executing program 0: r0 = perf_event_open(&(0x7f00000000c0)={0x8, 0x70, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, r0, 0x0) 10:06:04 executing program 2: r0 = socket$inet6(0xa, 0x1200000000000802, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x3, 0x4) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) syz_emit_ethernet(0x437, &(0x7f0000000700)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x401, 0x11, 0x0, @dev={0xfe, 0x80}, @local={0xfe, 0x80, [], 0xaa}, {[], @dccp={{0x0, 0x4e20, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}, "2b00b32def4f1142b6793bb530f9b20e90aa25d5c2b9431efd840a07c1922833b2c789aefbbaee9f63cbab38a8acfb8dba0595ecb683e74ea2bc44a7aee9c52e18ca01c06a5c354712b8b1ff75f45ba55a3487c83849023d37e037d2d3e3e842e9ba099e9ed8775d1173d8e78335aa65d58f54c1d78d4fce897cfefa24b7f268f90be76c7f4e1bfe4d84a869353e931c3732afea55697618a1318ecb657b34172b93fd59d7988d43630cf81e976a0ea01fd8b2547ab593bc605c985f56664b84ed3c9f90ffb666e030c794e2d2d5070af38d83dc275da88cfe6910b2ded59f6c418af5d247237eceb14857c1d7c3ee32e729d9793040f8f4e432eb875a89fe31cbed117f0e76643797169fba3dac3f377d145ce97980ba626da7a279e698a9e040a22d63c535f0ee06adb59e9e06ad7295e6601f3a5fe9b581975993c6c775734212bccb26288d42a672c965d40e80d0e1908f04425a60a08241378ec7ff88315de073b64c5f9647e51732be34988e0948f12e6c560bedbece811bca501d4389dbfe20e4df5160cd7324c0670c7b3e8980b061e31b1c8461d6f7a63f9e9fd24326924c076e01631a0b9703a6106accfaa064075fa1f16e16c5171b6a324e8642b2ab76618b824110c312ab12d9f65d6a980634a6a7cba8bf89e01a91259f446232476a1c490982636b78d1300befab1a2f6e8261e07336c5692db37bb7d3cebf4a942b62f2fa6cceb7e488aa02b2e52c6f82bd3792845fff41cce52e0469d14821ce11491864860c11421a92dae3152eb23106a0c679d2b1f0a9809b56abdcf893f9531508f24e64ec911fd8e8b3c8fd2291f1a7b910222c38533d4caadac9acd194be7e53549c1719bdf668887a0e19db83b5356f8f7d93cbef1ef3505dcc40d0d2a02a2745ab518979b9c3774babfe8e70ead767c7a00289b8cc6e51d1a957548270cb3f5064961a88f61b34f9442d78ae5a8551713f9afb4269d689f9adb6b4a902a637184f7f899efe9fa0ddb45cd1076c4eeeda51ca8dc20dcfc9cc5f56768073b3f4c2c9f543324a4fd0b8bc7b95e232bf85bf222394fa4336ab4007d7ad2dc85afa6eb79ad2624c4be6c674ee98fce9a51786b7cc2b5044de114d36d2690e13bcedf96590c7d5aeb8040b74c4d6a5aa38a7c1f0857522f4f968795056b9a7034dc3444784f9486b575e44dec3216d72845500e63297d7197961e7e593ea3411001d1d47ba42d70e7af8e91246c02d7e37ff0eb60abebc37dd00315b4fbb09e77a6b5f7e8441818ebcfafecf622731f1db8a11fa2de8e30d808bedbfee104b3b1100f5094675521da07dd2a28be7e486b325a0f0e6d75116be1bbc2aa20deb64a6e4e7b824b12d009e6f1802f5a8e31559b125d71d00a5684fbde4668f5af1eb4ca04fa7c4ef4d2a194b0856e007"}}}}}}, &(0x7f0000001780)) 10:06:04 executing program 6: syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0x2b, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [], 0xaa}, {[], @udp={0x0, 0x80040200, 0x8}}}}}}, &(0x7f0000000040)) 10:06:04 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x7a, &(0x7f0000000000), &(0x7f0000000180)=0x14) close(r2) close(r1) 10:06:04 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f00000000c0)='nodev\x00', 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1c000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, "10dec303415fe113b503cf1ae125cffac7e0f30f657e036d8beab09fd20f016238cbff4c48bedba30ba1508f70d88ebe0a077b1bb29ee38b71b351d15ce4ec82", "c3174cfe994a2869e5662e1e2a72e0fb4aee287df2df380b95e5b25a31c8f999938bfe8bf214ff8e583ea7b0e03ff510bcddd4757451a798594da244e721450c", "a2b98fba2b259731fba7132ce30a6db82958009e4ff06da85422d63bc7d0db26"}) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000200)) 10:06:04 executing program 3: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x0, 0x0, 0x6, 0x1}, 0xffffffffffffff48) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000080)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) open_by_handle_at(r2, &(0x7f00000000c0)={0x8, 0x1}, 0x0) 10:06:04 executing program 4: r0 = creat(&(0x7f0000001380)='./file0\x00', 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000600)=@assoc_value, &(0x7f00000000c0)=0x8) ioctl$fiemap(r0, 0x40086602, &(0x7f00000000c0)=ANY=[]) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f0000000000)='threaded\x00', 0x2) fallocate(r1, 0x3, 0x0, 0xffff) 10:06:04 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000f85000)={0x2, 0x1, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}}]}, 0x60}, 0x1}, 0x0) getpeername$netlink(r0, &(0x7f0000000140), &(0x7f0000000180)=0xc) syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0) ioctl(r0, 0xffff, &(0x7f0000000000)="d7264e59716a4b069b781e5d4016c981c58defb42fafa657d78048e2bc564c19f63c1a2179ffb7b3bf82ca5a72a2887430db50faee8a024fdcbf651443b253bebcc45c4b375dec01f6539dfa3ffd2a12a390ca1d1fa0838210bf82f9f80262b2616e7fcc835b7be4beb91546c529beefb5c7183150c2bd2a6477bac5ae38f7405b8d398e2f2bf402876777b9854899b91a0906ae45ca7d0f508ef4ac1b") 10:06:04 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000012fc7)}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f000000cf68)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000008f37)}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death={0x400c630f}], 0x1, 0x0, &(0x7f00000001c0)="10"}) 10:06:04 executing program 6: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") r1 = memfd_create(&(0x7f0000033ff3)='\x00', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000027ff3)='/dev/snd/seq\x00', 0x0, 0x20005) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000001440)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r1, &(0x7f0000001400)=[{0x0, 0x420000000003, 0x0, 0x0, @tick=0xfffffffffffffffd, {}, {}, @ext={0x0, &(0x7f0000038ffe)}}], 0x30) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f00000000c0)={0x12}) 10:06:04 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) listen(r0, 0x0) poll(&(0x7f0000000340)=[{r0}], 0x1, 0x0) 10:06:04 executing program 1: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x8200) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-512-generic\x00'}, 0x58) r3 = accept$alg(r2, 0x0, 0x0) sendfile(r3, r1, &(0x7f0000000000), 0x2) 10:06:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0247e22f05d02c99240970") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f00000001c0)={0x7b, 0x0, [0x40000000]}) [ 92.438866] binder: 7117:7123 unknown command 536907575 [ 92.451585] binder: 7117:7123 ioctl c0306201 20008fd0 returned -22 [ 92.465689] binder: 7117:7130 BC_CLEAR_DEATH_NOTIFICATION death notification not active 10:06:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x3}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x3000000000000022, &(0x7f0000356000)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000300)='6', 0x1, 0x200418cf, &(0x7f0000000100)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x3}, 0x1c) 10:06:04 executing program 4: ioctl$sock_ipx_SIOCGIFADDR(0xffffffffffffffff, 0x8915, &(0x7f0000000140)={'syzkaller1\x00', {0x4, 0x0, 0x0, "353224411683"}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) utimensat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={{0x0, 0x2710}}, 0x0) [ 92.505737] binder: undelivered death notification, 0000000000000000 10:06:04 executing program 2: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) unshare(0x64000400) signalfd4(r0, &(0x7f0000000000), 0x8, 0x0) 10:06:04 executing program 3: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:04 executing program 6: r0 = socket(0x10, 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000000000), 0x4) 10:06:04 executing program 5: syz_mount_image$gfs2(&(0x7f0000000240)='gfs2\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x0, &(0x7f0000000880), 0x0, &(0x7f0000000980)={[{@norgrplvb='norgrplvb', 0x2c}]}) 10:06:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, &(0x7f00000002c0)) [ 92.773145] IPVS: ftp: loaded support on port[0] = 21 [ 92.920882] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 92.927485] gfs2: not a GFS2 filesystem [ 92.939162] TCP: request_sock_TCP: Possible SYN flooding on port 20000. Sending cookies. Check SNMP counters. [ 92.991377] gfs2: not a GFS2 filesystem 10:06:05 executing program 1: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:05 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000) mlock(&(0x7f0000ff3000/0xd000)=nil, 0xd000) 10:06:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000480)={0x10}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x14, 0x20, 0x1, 0x0, 0x0, {0x7}}, 0x14}, 0x1}, 0x0) 10:06:05 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000004c0)=@broute={'broute\x00', 0x20, 0x1, 0x240, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000280], 0x0, &(0x7f0000000240), &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x86dd, 'syzkaller0\x00', 'tunl0\x00', 'sit0\x00', 'ifb0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x128, 0x160, 0x1b0, [@ip6={'ip6\x00', 0x50, {{@empty, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, [], [], 0x0, 0x0, 0x30}}}, @mark_m={'mark_m\x00', 0x18}]}, [@common=@dnat={'dnat\x00', 0x10, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}}]}, @common=@LED={'LED\x00', 0x28, {{'syz0\x00'}}}}]}]}, 0x2b8) 10:06:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000002c0)={0x8, 0x0, [{}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x5}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb034d564b0000000001"]) ioctl$KVM_X86_SET_MCE(r3, 0x5000aea5, &(0x7f0000000140)) 10:06:05 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$inet6_sctp(0xa, 0x200000000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x72, &(0x7f0000ad2000), &(0x7f0000000080)=0x23c) 10:06:05 executing program 3: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:05 executing program 7: syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000780), 0x0, &(0x7f0000000880)={[{@block={'block', 0x3d, [0x39]}, 0x2c}]}) 10:06:05 executing program 2: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:05 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x890c, &(0x7f0000000340)="9cd8c7f6ffe432bba24e8ff002a6432671c4ac9a31a221f723c3b3d67817a9fa962af39467fd9842537300000000000000003e4d4d") 10:06:05 executing program 0: getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f0000000600)={0x0, @in6={{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, &(0x7f0000000180)=0x84) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0x0, @multicast1=0xe0000001}}, 0x5}}, &(0x7f00000016c0)=0xb0) kexec_load(0x0, 0x7, &(0x7f00000005c0), 0x0) 10:06:05 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000fdb000)='ubifs\x00', 0x1003, 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='tracefs\x00', 0x80000, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000187ff8)='.', &(0x7f0000753000)='mslos\x00', 0x28a1000, &(0x7f0000000000)) 10:06:06 executing program 3: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:06 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:06 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000fdb000)='ubifs\x00', 0x1003, 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='tracefs\x00', 0x80000, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000187ff8)='.', &(0x7f0000753000)='mslos\x00', 0x28a1000, &(0x7f0000000000)) 10:06:06 executing program 7: r0 = syz_open_dev$tun(&(0x7f0000008940)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"79616d300001178b00", 0x4012}) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000000)={0x0, 0x2aaaaaaaaaaaab8b, [@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}]}) 10:06:06 executing program 1: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f00000006c0)=ANY=[@ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="34d4f1011100c11de4165307"]]], &(0x7f0000000040)=0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pipe2(&(0x7f0000000000), 0x0) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x60, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:06 executing program 2: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:06 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340)="cd70fb6b4ec6dfa5422d65d82bf423a38c544f69472df737d42f122390d1191b15", 0x21) 10:06:06 executing program 7: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000775000)) 10:06:06 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip6_flowlabel\x00') sendfile(r0, r0, &(0x7f00000000c0)=0x5, 0xdd) 10:06:06 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000fdb000)='ubifs\x00', 0x1003, 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='tracefs\x00', 0x80000, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000187ff8)='.', &(0x7f0000753000)='mslos\x00', 0x28a1000, &(0x7f0000000000)) 10:06:06 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r1, 0x5eb857) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) r3 = accept4(r1, &(0x7f0000975000)=@can, &(0x7f0000752ffc)=0x10, 0x0) sendmmsg(r3, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000002140), 0x0, &(0x7f0000002180)}}], 0x1, 0x0) accept$ipx(r1, &(0x7f0000000080), &(0x7f00000000c0)=0x10) sendmmsg(r3, &(0x7f0000000c00), 0x4000000000001e6, 0x0) 10:06:06 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970") unshare(0x400) r1 = socket(0x1e, 0x1, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000100)) 10:06:06 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000fdb000)='ubifs\x00', 0x1003, 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='tracefs\x00', 0x80000, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000187ff8)='.', &(0x7f0000753000)='mslos\x00', 0x28a1000, &(0x7f0000000000)) 10:06:06 executing program 7: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000775000)) 10:06:06 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000775000)) 10:06:07 executing program 3: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f00000006c0)=ANY=[@ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="34d4f1011100c11de4165307"]]], &(0x7f0000000040)=0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pipe2(&(0x7f0000000000), 0x0) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x60, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:07 executing program 5: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = fanotify_init(0x5, 0x0) fanotify_mark(r1, 0xd, 0x48010010, 0xffffffffffffffff, &(0x7f0000000040)='/\x00') 10:06:07 executing program 7: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000775000)) 10:06:07 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000775000)) 10:06:07 executing program 1: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:07 executing program 2: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) fallocate(r3, 0x0, 0x0, 0x5) creat(&(0x7f0000000000)='./file0\x00', 0x0) dup2(r1, r2) 10:06:07 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = creat(&(0x7f0000000080)='./file1\x00', 0x0) r2 = creat(&(0x7f0000000140)='./file1\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x4bff) pwrite64(r1, &(0x7f0000000400)="793bc64d02a434298c5edce59572ea8ffec28c1d0ee3715092459207fe850a55a4f8844314ad1ef00a7e6c92aed8dd67108118e2ad55d411c765af947111ccdda3129846aecd4ef4434f15bf149ef6f6da0c59aed05edbfed51123fddf2ad83fda1a94322695a8dde7d59a3c49cb3820e9c47b0a4160d156fa40b19dd77b35dec80d207fd1e96f4b841be24d632b7f81a9bf014090eed210ea684444a63ca074bd036ce656736b949f1faf8110d9dc876baa773311fb03c5c1f345d141be4d859875407979941be8a18b0e706da5590659a91da85ef50efe0733e6b23e7ff6ec4d29a8024b72b7fff393c99d336100525cea3783ec85484a859b0ad6519561dc06628fb170bc076751a86ae7693296152272df91b5fe774c908f7f6d35ee9df70e4187b070a427cd1708a8a6ab8560423830da27010b2528a58d305c8fbd0c9ba3135c2723a606bb6c1b6e0b76e5d9ad5136579c7fc1fbd101c84cbd5de08e10adab0fed25389f245c09bde0be7c783f9c4d5ce655b6bd1033186a78a2ac7596e84fa3461aa09a4cb2a5df1e61acc15a8f4a5ae32cf7895f683e8230d03bc7b21a91b4482b692f616e89f38aaf9846105064b2c703d7ba915dba889cbfe730080b3699a96ca2d7aa711c5f1c70615bea82524c36101b79184f1e9a3c2290db838e15c7ad3d7c11673e07fbbf9942ad796715b0b253fe9fada33eb485e8b8b494d23731eebec4cb3a5aa0d9fa6975591b59c621f8f284426b7cd1f0d2436151efe5396b23fdc9f0f48743221ff90db37a45652450c872301ae862caeac6d610612f2258135cefd77cda795dbfafce1c98a751eb62828b246f5c71a628ff60f352e818835a40b4eb872fddade12f48708cd23ac81dd19788316aef11bc65c8d21d382191719373a7c78ea0aa1950801486180132519befb262b1623a50302d8a656c279108b07aeccdaf7efe96cfc731a2bf733f85a7076804729186d2b487d7202ae496d85dacb5a267f8f7d268f7081acc8740db0a3ef9d2eb22b93697a64024f7a3d11e208067fd34316bfe67a21285438f55579b108cfcd0834ca2fc3ab76b7cd4fc0726bf933ecd52bfc45ec53f203f4a6b43eac1898c2e9f711bb9b6fbf2909a3f9b8d0d6de3f68b415e779c67ab9802e1c9180bc8f8276ef6609ef0f901a3ee686fc2807123aeb200fd4cc7286d4c66a64499a53a5d18e550af5511ab23fb36025b1f8af27618c7590f5a957616c5c8a93958b8007b16af4ae2d0cc3f7fce5aea39c1f864a0391295bc41c50a0b4d1348937cb89b4c55befd3ad65d1bb799742855f7a2aa1e7d206db03509dadc9bc4c410c9ab4bed95fc3b5b775dd8df4ece6165bd462cc50e3072454f2dc7746e87caec8f1abce8bad1719a7ede8ef06970cd5b7ca48aab77ca411ae35900cf6f5186fd15aae0d03cb6623c392f552d17f7d881c1cb71fa85c40dfb3a424a07cf2e9b00dee151f1f956ef7fac8fcd4b56d9f3d7e6c26cfaa98dbce27c14a07e44dcd050b70626bc0191c764ef531ff6c05fb01f452a730600232d8fa24c69611754a0bc6e612e15616237e8b5015bfba57e55640864df95fdf2dfba25ae2c04e91c2ff5e061f56f4709999c70ac855b4f30eba60249ac88be38ce44ef844785e4f2aab3abf1134c0303fc5b935227392da527a582543576c6b27eac08f2f5c20884d7aae11c12078f23496c11295bc3f41f1f05c5b4337bca43de6aa3e7eaab1917eb32fd467896b41fecd70d224a0095fff85e6036e14b8965eac21a9364a6f19bc2684a2e063c0db11a71486dbe6df70059377802778f4e3a4d31036ad214a0577d7f882ad0e48c0c97c183126274eb6607f8ad9483b8e9f0285777b4a99ad297b4fd16df94571d62c35488bd39982115faf0d01f045aee6d8f2f0701d9628616b74b2fd12644894cc529c959b7e535135bc77c01a0fc67212795aef5219b4610c1402692f10d346f0d997020a0bc9e29b7bc024d44ebfa89671038d8571d5e31fa04b2cb41d4f6b4996d34e985ea734d626c341d15c1fe03014822bcc073a0d3eac04abdb14e5b1762d3bdb415f0f90bdff735d3922bcee933a402883f218b9d5877bdc62f4a2a1526ae37e366b8050450ad2b61e6b2a849dc2d9d172d9713de927517fc83370a869fc01f364afd1b1af1b90af54c835d7b62507a23495a31bc1123e3c3ef0c8b8a95c58fdb4a20e301bc3bc6b5efde14fe51e6ee4b86d1fcb65396136a7d3d8a5b8ba73505a5130b9ff230a2a18b0c215e7da6ad898da9e9a813109ab0ef401151a9c95e5c2ef05a5e987916a1ccac089747006b13618714d1143aa9cef2995257a1d3257c4078743ae8a802938c9a9bf1518aae119ee5986f796fc3280a467dc1ed566458cf187d0e513f2e25d141f724443cb99e4b9d3f140ad0ce6332762436ecb7497eb865f1f638f2242952ae403bd18782eab9ff0d2800bf582a43da346786a45087e48f5177445bc06a4eee83f95916327e684babafb8fc9f3eaeeab6a4a56f80c4515a3d3a8315c94d724aea8832a8b315f95382f2c5d2d51dfcdca7a6e8747ad5e73d7a50c1d7d7163fba5069f439ad7a866338cf33ba813f4ba4fe00d55e09394b1cd0f514b3cdf5b506a3741da53b9aac96afcd083c5fa9dd98be3ccfc6136cf684aa43df8b1212403e7b5e82ac343170cf47d7de21a3e68558b89f58ca12ce884cee1cc9c1ce2c86dc8a7baf1887cf1613102938fe8897eaaafd5e45da47e7a9c0fa93604a8ec783f9b30cf0f4573dbb552f355a8111556a5b8ebd4d0d95718480b19adb87d26e5f9a984bcc9aad6b19fe75b3375e841637871e4dd442a823a65829c5e5030d9d163d639b78bf7ca8a542c14b7bf626023e45a31c668e00b869db990d1cec19b500adedb7edc82b4138f22e27faced27a9bcd614c5bf05cc905f25f61e9faa66848cac5db4aebfcbaf672dbd3c87f9d07606acf76182b1d13338b67887c5f1b68f1f3edda2e737636d05ffa636a2baf502cbf8c42353cdb8598c8b0a0871331ab2d3b14208d49e95dc62841bc66c24f021fcbc8112412887e5254d00413a5d693c5995609864716999f840341b3dd2b4b6a10371623e51e2ce222b3025ada9f13a30c097b04f263d49193680ea3fbfb7e08944a5dd54f50862d16b4c7ae7122de0172f2d5bdb921f7f99951c5d58555c408b2f2391ef116ede48e385d5c3af211b0d2786fd8825446083fc7a234a82c18e494fe51f1dc174bc02351128ba91cf8443669e758202c4b55a8f0a4ddea4f4c2c24e3da6e3646e3a629e966191ff72529db0932d4ddda15c9131b60214225e9427c324c7f9b73e14948ea1f2f89e9ecf6e463298d4baa865fde3b1f841c9dca52a7989349ae38c8910d997e793478219a1647bfeae851d5d91abb75735d302e87d5e1fc95071fd19a417902933ed98fbc6f35bd4bd18d0ee18a2304be94e42137c39a2c688f8061b5707918f480d2e1520d8554bb5e7fcbc392efbc3fb9847dac6149d941185e59593bd74899b50d3bbd84f3cd090980c15574ee92e85258a836b9124ba0d087a943e7b51b87a3b1dba1932ea151a6c02d01f4b8715ce4d1ddbbae31bd4a1f6afe0702d227edc370af1197a0ef454919d3a1f058ac939dfe8653d2f4b6f5ee91b1cb0643cb2bb059afe6c46fb0741ba260e21cdd20c59e352fac4828dd757c00816df2d800632fdf3c27a517aa0bfc4318240b946516558c28319900cab78d031362f9eb580c9ed19d78405e855b75ef70bbbf35944c4caf13effc63a3b047b257c7387ca5701ac578f94db02ce791c116447614418130463af98ce64de968e5c09a4912a063dafdd515259dc89fdfc551c0b0d4e443a4d1fea0de50bb9197e41793743377d07164b1b8c182d6232b7525819af73e0be8b72c07859517e09187d21626790138bee51d418dc39892b76a272e472868f8b3ef1cecd8a9528670d2a34fb4f7124cfcf875e9c52935afadf4fb916f107522e84178435cf5763e96d046e955b7061db67bfff946a8b16f16e58a4a1dcc185181746161d8fe8ea18b0986ef1b7a395ab7b0e60224b70060c9c308c035940ca88f47c3d025f609862248043b751e1f0f324ed05e9b8159eae4d859bc529dc9425beafdc25c1acdbca158969aa4254fb34471d8eef92f37808b5c7b6ae2999de7950307f52b992fc75b730b5f2e9543ca6b1d3d1e5db5739993ef459ed66897bd01a44f7dadb8e777d8a7575f5a2f4d18bcc56b15e89e3ba3e26dbd314eeaa6d4009fec869abd17dd42fc1067fa9d8b7de477749b3c43e0e96da0695d392a37961ce01de1dcb92b2713181f97a75f1de9ca94412a722d65b1063b96353f7136cbd079a4d7339e6a4e0e074e3768b8aa2b3024fefd372afe80bf5826bbd7e8a059755eb1b90b914982f7bf2972ff3853bc025d16f48f7a4f3462b90b7aa78cd61d2c946c9433e10220cac7ca0b925d81d0193f585b71153c53a0f6e9f49421b2bc0db9a2a3525276487b95a460ff1ec9799b0ad1c2310c8fe95e023bb377c4ebede9731d2117d7a4b4810cca6d43e3fcccc7d12aad0cd6a52c0b739716f393ac9956934fd71e276d009da7513e8a2e75358e9f1c90dc32145c6748621694ee7b99c7d0b567798b4e82563a34f6adf35ac19979983a37c6a5a99f5940867b3c1ebcc31e7100818a2c49ce2d3bb270da8e1193f2f5427fa4590aed65d9d06c8ca3c1bac934207b2dbefd951ece0a68b741a8308232655909c195c43488e92fa7c393e35c2b84924e0a9008926e4c34d9205f3e93a03f7ca32400ec1eed719b683106ac1f49ee9ee201c0070509c072bad8d315a17e31bd6991af15c6593a1c08806a119283b550e753d323e7df3fac9a3f68380db2e84c04c28c2d06dfc12c186f4aeefd6ca9c0bfad1bf3e5f1562db01ea29ecf7641d818376e778accff02508c8c138ba250a4165cc7740faf0d3413a2dfe827f2ea58781151d8f663a3dc5471d01f8c6178aaa9eeb6b5fde3063ce3a2bf0aa0bfaf96b10cd9dfd1a5178f4bdbf0c4a16fc4d4678e001caab96e1c", 0xe00, 0x0) fadvise64(r2, 0x0, 0x0, 0x3) 10:06:07 executing program 7: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000775000)) 10:06:07 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a}, &(0x7f0000000180)="a4", 0x1, 0xffffffffffffffff) r1 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a}, &(0x7f0000000300)="848432503e1ac2bae9d92c5d144121fbb1962144eae8978bd4f065eadead9ca85fd3c49e925de4007488bf80a2152f25efb149bbddc4493ad0c625b2e5cfabf2f745b9a6586673f693fc49f3b2e10e38afb34f9befefa874c9e7033ccc0e967bec6de22d59ece236cb34ca95781888a02e9796e3342b40b123e5f81ff5e36b907efecba4cfbf634fd3fe7f546dba4cdcc4fe13ac83893eef8276820db8efd0e90729fb71a71d96dd945238acddb8375d4b349d571748902d266efb9ab909b8b6", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000480)={r0, r1, r0}, &(0x7f00000004c0)=""/155, 0x9b, &(0x7f0000000100)={&(0x7f0000000400)={'md5-generic\x00'}, &(0x7f0000000080)}) 10:06:07 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000775000)) 10:06:08 executing program 6: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x2c871, 0xffffffffffffffff, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r1, &(0x7f0000000fc0)=@connect={0x6, 0x0, 0xfa00, {{0x0, 0x0, "35a0d9ef371f53883217347d0b722a2ca1088f963c643402a9951e296e90539664d6ad6a085038efc6250615b2236032eb2b0d3cbb511be984900e07712a1a6710345b107f93bf06df91aeb5d7efca8a547af0e367b03d1cc2b07e8aedc3049a3f89a20df20a6086eaa71f23c881f2f8cb0846debe4a0205792830af6e59e19e0a7cbbc675aa8ed6dcbe057196f085d45d4e621028a88da3b4d3cc2f47a4832603ca7cc1a060bf384a1590d22e624048fd73e7c95bec8e8fa4e7a1062330bab6cc47630d1e20051c40c882d80995afd58caa879f5da96d1a16fa40549964458898a82f4444b5bbbca0411fb2b4cd1e919ba173a74a6be08b2a86296df3f6e0cf"}}}, 0x1f2) 10:06:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb0001004000"]) 10:06:08 executing program 7: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0x2b, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [], 0xaa}, {[], @udp={0x2c00, 0x0, 0x8}}}}}}, &(0x7f0000000040)) 10:06:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f00000006c0)=ANY=[@ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="34d4f1011100c11de4165307"]]], &(0x7f0000000040)=0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pipe2(&(0x7f0000000000), 0x0) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x60, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:08 executing program 0: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000100)="0047fc2f07d82c99240970") read(r0, &(0x7f0000000280)=""/151, 0x97) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000016) tee(r3, r1, 0x6, 0x0) write(r4, &(0x7f00000001c0), 0xfffffef3) 10:06:08 executing program 1: r0 = socket$inet(0x2, 0x1000000003, 0x88) sendmmsg(r0, &(0x7f0000006780)=[{{&(0x7f0000000340)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x80, &(0x7f00000000c0), 0x0, &(0x7f0000000940)}}, {{&(0x7f0000000080)=@in={0x2, 0x0, @rand_addr}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000000)="990db42d", 0x4}], 0x1}}], 0x2, 0xc0c0) 10:06:08 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000002000)='asymmetric\x00', &(0x7f0000001ffb)={0x73, 0x79, 0x7a}, &(0x7f0000001fee)="3a74670000000000008000080265783a30d1", 0x0) 10:06:08 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4002, 0x0) io_setup(0x5b3, &(0x7f0000000040)=0x0) io_submit(r1, 0x111, &(0x7f0000001540)=[&(0x7f0000000140)={0x0, 0x0, 0xd, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 10:06:08 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1d}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000100)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffbd}, [@ldst={0x7, 0x1, 0x0, 0x0, 0x7a}], {0x95}}, &(0x7f0000003ff6)='syzkaller\x00', 0x5, 0x450, &(0x7f000000cf3d)=""/195}, 0x48) 10:06:08 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'hash\x00', 0x0, 0x0, 'vmac(cast6)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) 10:06:09 executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000500)={0x0, 0x10, &(0x7f00000004c0)=[@in={0x2, 0x0, @dev={0xac, 0x14, 0x14}}]}, &(0x7f0000000540)=0x10) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000300)=0x7, 0x4) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000100), &(0x7f0000000140)=0x4) 10:06:09 executing program 0: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x1f00000000000000, 0xcd, &(0x7f0000000000), 0x3c) 10:06:09 executing program 3: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r0) r2 = socket(0xa, 0x3, 0x51) ioctl(r2, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") getsockopt$sock_buf(r1, 0x1, 0x1c, &(0x7f0000000040)=""/201, &(0x7f00000001c0)=0x10) 10:06:09 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb0001004000"]) 10:06:09 executing program 7: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x400000082002, 0x0) write$sndseq(r0, &(0x7f0000000380)=[{0x0, 0x0, 0x0, 0x0, @tick, {0x81, 0x4}, {}, @control}], 0x30) 10:06:09 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000002000)='asymmetric\x00', &(0x7f0000001ffb)={0x73, 0x79, 0x7a}, &(0x7f0000001fee)="3a74670000000000008000080265783a30d1", 0x0) 10:06:09 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000380)={'nouuid,', {[{@swidth={'swidth', 0x3d}, 0x2c}]}}) syz_fuseblk_mount(&(0x7f0000000680)='./file0\x00', &(0x7f0000003000)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x200, 0x0) 10:06:09 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f00000006c0)=ANY=[@ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="34d4f1011100c11de4165307"]]], &(0x7f0000000040)=0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pipe2(&(0x7f0000000000), 0x0) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x60, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:09 executing program 7: r0 = socket(0x2, 0xa, 0x0) bind$netrom(r0, &(0x7f0000000100)=@full={{0x3, {"50de0e1e06a2ab"}}, [{"96cde6c5ee0e4d"}, {"4bcd76b74503e7"}, {"d95cff71bdb533"}, {"d0018f1a42e1a9"}, {"a01b13052d54db"}, {"ccbd52ff8b78cd"}, {"74f0ccfca58a00"}, {"7231b23f154da0"}]}, 0x48) 10:06:09 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = socket$inet6_sctp(0xa, 0x200000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000961000)=[@in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, 0x4}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={r2, 0x368}, 0x8) 10:06:09 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000002000)='asymmetric\x00', &(0x7f0000001ffb)={0x73, 0x79, 0x7a}, &(0x7f0000001fee)="3a74670000000000008000080265783a30d1", 0x0) [ 98.197642] syz-executor7 uses obsolete (PF_INET,SOCK_PACKET) 10:06:09 executing program 0: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x3) read(r0, &(0x7f0000003380)=""/4096, 0xf) creat(&(0x7f0000000500)='./file0/.ile0\x00', 0x0) [ 99.263193] syz-executor3 (7453) used greatest stack depth: 13160 bytes left 10:06:10 executing program 3: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb64c86d6b66732e66617400020441000500077008f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) utime(&(0x7f0000000000)='./file0/file0\x00', &(0x7f00000000c0)={0xffffffffdffffff6}) write$binfmt_script(r0, &(0x7f0000000280)={'#! ', './file0/file0', [], 0xa}, 0x11) 10:06:11 executing program 7: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000180)=ANY=[], 0xfffffd97) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setns(r0, 0x0) mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0) syz_mount_image$bfs(&(0x7f00000000c0)='bfs\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x2, &(0x7f0000000900)=[{&(0x7f00000001c0)}, {&(0x7f0000000480)="5c1067ae13589258cc6cd446bfeaef6faf003fbc4dbc", 0x16, 0x7}], 0x0, 0x0) futex(&(0x7f0000000100), 0x109, 0x0, &(0x7f0000000000), &(0x7f0000000040), 0x0) 10:06:11 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000380)={'nouuid,', {[{@swidth={'swidth', 0x3d}, 0x2c}]}}) syz_fuseblk_mount(&(0x7f0000000680)='./file0\x00', &(0x7f0000003000)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x200, 0x0) 10:06:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb0001004000"]) 10:06:11 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000100)=[{r1}, {r0}], 0x2, &(0x7f00000001c0)={0x77359400}, &(0x7f0000000200), 0x8) 10:06:11 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000002000)='asymmetric\x00', &(0x7f0000001ffb)={0x73, 0x79, 0x7a}, &(0x7f0000001fee)="3a74670000000000008000080265783a30d1", 0x0) 10:06:11 executing program 6: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) fchown(r0, r1, 0x0) fchown(r0, 0x0, 0x0) 10:06:11 executing program 0: ioperm(0x0, 0x7, 0x7ff) 10:06:11 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00') write$cgroup_pid(r1, &(0x7f0000000200)={[0x2b, 0x39]}, 0x2) 10:06:11 executing program 6: futex(&(0x7f0000004000), 0x400000085, 0x0, &(0x7f0000001ff0), &(0x7f0000004000), 0x0) 10:06:11 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000003cc0)=[{{&(0x7f0000002580)=@nfc={0x27}, 0x80, &(0x7f0000003900), 0x0, &(0x7f0000003980)}}], 0x1, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa}, 0x1c) 10:06:11 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xfffffffffffffffd, 0x5c831, 0xffffffffffffffff, 0x0) 10:06:11 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}, 0x1c) listen(r0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x50f, 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000ac1414aa0b4824ca945f64009400050028925aa80000000000000080000efffeffe809000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 100.147291] syz-executor2 (7497): /proc/7494/oom_adj is deprecated, please use /proc/7494/oom_score_adj instead. [ 100.216922] hrtimer: interrupt took 27277 ns 10:06:12 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000d12000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)) sendmmsg$unix(r1, &(0x7f00000bd000), 0xfffffffffffffdc3, 0x0) close(r0) 10:06:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb0001004000"]) 10:06:12 executing program 6: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x0) r2 = memfd_create(&(0x7f00000000c0)='nodev\x00', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x17, 0x0, "10dec303415fe113b503cf1ae125cffac7e0f30f657e036d8beab09fd20f016238cbff4c48bedba30ba1508f70d88ebe0a077b1bb29ee38b71b351d15ce4ec82", "c3174cfe994a2869e5662e1e2a72e0fb4aee287df2df380b95e5b25a31c8f999938bfe8bf214ff8e583ea7b0e03ff510bcddd4757451a798594da244e721450c", "a2b98fba2b259731fba7132ce30a6db82958009e4ff06da85422d63bc7d0db26"}) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000200)) 10:06:12 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000000)={0x1f}, 0x8) listen(r0, 0x0) connect$bt_sco(r0, &(0x7f0000000040)={0x1f}, 0x8) 10:06:12 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000000)={{}, {}, {}, {0x0, 0x11f004, 0x0, 0x0, 0x7fffffff, 0xc, 0x2, 0x2, 0x0, 0x0, 0x6d50}, {0x2004, 0x0, 0xf, 0x9, 0x6, 0x2}, {0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0x1, 0x0, 0x81}, {0x0, 0x3000, 0xd, 0x5, 0x7ff, 0x0, 0x0, 0x0, 0xc8}, {0x0, 0x16000, 0xf}}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000580), 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000040)="c4c27d1a28f04083248bccc4e3791d170066430f3a41e000b9a10a0000b8ed000000ba000000000f30c462d1bafe440f3566baf80cb88c91668aef66bafc0cec66b8d8008ec80f0118"}], 0x1, 0xfee64b5def490aec, &(0x7f0000000340), 0x100000000000024d) setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x14) ioctl$KVM_RUN(r5, 0xae80, 0x0) 10:06:12 executing program 2: r0 = socket(0xa, 0x1, 0x0) unshare(0x40000000) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000056c0)={&(0x7f0000000080)=@setlink={0x34, 0x13, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_IFNAME={0x14, 0x3, ':eth1\x00'}]}, 0x34}, 0x1}, 0x0) 10:06:12 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000380)={'nouuid,', {[{@swidth={'swidth', 0x3d}, 0x2c}]}}) syz_fuseblk_mount(&(0x7f0000000680)='./file0\x00', &(0x7f0000003000)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x200, 0x0) 10:06:12 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(tnepres-generic)\x00'}, 0x58) recvmmsg(0xffffffffffffffff, &(0x7f00000061c0)=[{{&(0x7f0000003700)=@ll, 0x80, &(0x7f0000003b40)=[{&(0x7f0000004ec0)=""/4096, 0x1000}], 0x1, &(0x7f0000003bc0)=""/81, 0x51}}], 0x1, 0x0, &(0x7f0000006400)) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000002a80), 0x2f7, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r2, &(0x7f00000015c0)={&(0x7f0000000180)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000001340)=""/53, 0x35}, {&(0x7f0000001440)=""/190, 0x436}], 0x2, &(0x7f0000001580)=""/31, 0x1f}, 0x0) 10:06:12 executing program 3: r0 = socket$inet6(0xa, 0x1001000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0xe) ioctl$TCFLSH(r1, 0x80047456, 0x6f4000) [ 101.045855] IPVS: ftp: loaded support on port[0] = 21 10:06:12 executing program 5: r0 = socket(0xa, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@nat={'nat\x00', 0x19, 0x1, 0x1d0, [0x200001c0, 0x0, 0x0, 0x200001f0, 0x20000220], 0x0, &(0x7f0000000040), &(0x7f00000001c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'bcsh0\x00', 'veth1\x00', 'lo\x00', 'veth1_to_team\x00', @empty, [], @empty, [], 0xa0, 0xd8, 0x110, [@m802_3={'802_3\x00', 0x8, {{0x0, 0x0, 0xf202a74251e4fc54}}}]}, [@snat={'snat\x00', 0x10}]}, @snat={'snat\x00', 0x10, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}]}, 0x248) 10:06:12 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) open_by_handle_at(r0, &(0x7f0000000040)={0x9, 0x2, '\v'}, 0xffff8005) [ 101.235842] IPVS: ftp: loaded support on port[0] = 21 10:06:12 executing program 7: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) close(r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000219fa8)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000001f3a)="ad56b6c5820faeb995298992ea54c7be", 0x10) r2 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f00000030c0)=[{0x0, 0x0, &(0x7f0000000380), 0x0, &(0x7f0000000400)}, {0x0, 0x0, &(0x7f00000008c0)}, {0x0, 0x0, &(0x7f0000002f80), 0x0, &(0x7f0000003040)=[@assoc={0x18, 0x117, 0x4}], 0x18}], 0x3, 0x0) 10:06:12 executing program 5: r0 = getpgid(0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x1) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000f86000)='./control/file0\x00') syz_fuse_mount(&(0x7f0000000240)='./control\x00', 0x6000, 0x0, 0x0, 0x0, 0x0) syz_fuseblk_mount(&(0x7f0000000140)='./control\x00', &(0x7f0000000180)='./control/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r1) 10:06:13 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000380)={'nouuid,', {[{@swidth={'swidth', 0x3d}, 0x2c}]}}) syz_fuseblk_mount(&(0x7f0000000680)='./file0\x00', &(0x7f0000003000)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x200, 0x0) 10:06:13 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000480)='/dev/dsp\x00', 0x0, 0x0) read$eventfd(r0, &(0x7f0000001000), 0xfffffe53) mmap$binder(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3000003, 0x2012, r0, 0x0) 10:06:13 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000680)={0x1c, 0x18, 0x1, 0x0, 0x0, {0x1}, [@nested={0x8, 0x3, [@generic="9c"]}]}, 0x1c}, 0x1}, 0x0) [ 101.959245] IPVS: ftp: loaded support on port[0] = 21 [ 102.980552] device bridge_slave_1 left promiscuous mode [ 102.986682] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.014688] device bridge_slave_0 left promiscuous mode [ 103.020250] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.154411] team0 (unregistering): Port device team_slave_1 removed [ 105.164979] team0 (unregistering): Port device team_slave_0 removed [ 105.176438] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 105.194919] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 105.223638] bond0 (unregistering): Released all slaves [ 105.876855] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.883255] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.891929] device bridge_slave_0 entered promiscuous mode [ 105.956922] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.963328] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.989919] device bridge_slave_1 entered promiscuous mode [ 106.040430] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 106.079097] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 106.245320] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 106.285990] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 106.356275] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 106.363189] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 106.418673] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 106.425581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 106.587352] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 106.601687] team0: Port device team_slave_0 added [ 106.665349] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 106.672719] team0: Port device team_slave_1 added [ 106.731305] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 106.811061] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 106.849656] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 106.856839] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 106.865390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 106.905941] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 106.913216] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 106.928119] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 107.294410] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.300810] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.307424] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.313784] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.321801] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 108.111798] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.189093] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 108.264835] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 108.271057] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 108.278364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 108.286771] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 108.355115] 8021q: adding VLAN 0 to HW filter on device team0 10:06:20 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000ff7)='/dev/ppp\x00', 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000001000)=[{&(0x7f0000000040)="1a03", 0x2}], 0x1, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000004c0)=""/246) ioctl$EVIOCGREP(r0, 0x4010744d, &(0x7f0000001000)=""/174) 10:06:20 executing program 4: r0 = socket(0x10, 0x2, 0x4) sendmsg$nl_crypto(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@delrng={0x10, 0x14, 0x1}, 0x10}, 0x1}, 0x0) 10:06:20 executing program 5: r0 = getpgid(0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x1) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000f86000)='./control/file0\x00') syz_fuse_mount(&(0x7f0000000240)='./control\x00', 0x6000, 0x0, 0x0, 0x0, 0x0) syz_fuseblk_mount(&(0x7f0000000140)='./control\x00', &(0x7f0000000180)='./control/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r1) 10:06:20 executing program 2: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") sendmmsg(r0, &(0x7f0000001200)=[{{&(0x7f0000000a00)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000b00)="df", 0x1}], 0x1, &(0x7f0000000c40)}}], 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100)={0x303, 0x33}, 0x28) sendto$inet6(r1, &(0x7f00000005c0), 0xfffffdef, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040), 0x4) close(r0) 10:06:20 executing program 0: r0 = add_key(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a}, &(0x7f0000000200)="10", 0x1, 0xfffffffffffffffb) keyctl$assume_authority(0x1d, r0) 10:06:20 executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6, 0xfffffffffffffffc}, 0x4) r1 = socket(0x40000000002, 0x3, 0x2) dup2(r1, r0) 10:06:20 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002c80)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000002b40)=[@text64={0x40, &(0x7f0000002ac0)="66b839010f00d8460f0666baa000ec470ff5b671000000c421f913b24ea5f4b80f32f240dff066410f744de2400f01f848b801000000000000000f23c80f21f835000020000f23f8", 0x48}], 0x1, 0x0, &(0x7f0000002b80), 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f00000000c0)="266464f2f0806ead000f08c744240007000000c744240200980000c7442406000000000f011c24d0f0c4e1fc5a685866baa000ed66baf80cb8b14cb385ef66bafc0cb033ee0f20c035040000000f22c064f4c4e1781726", 0x57}], 0x1, 0x63, &(0x7f0000000180), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:20 executing program 1: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = socket$inet6_sctp(0xa, 0x200000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000961000)=[@in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, 0x4}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x14, &(0x7f000095cffe)={r2}, &(0x7f000095c000)=0x8) 10:06:20 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@delneigh={0x28, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@NDA_LLADDR={0xa, 0x2, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}]}, 0x28}, 0x1}, 0x0) 10:06:20 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x2, 0xc) write(r1, &(0x7f0000594000)="1f0000000104ff00fd4354c007110000f305010008000100010423dcffdf00", 0x1f) dup2(r0, r1) 10:06:20 executing program 3: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f000007d000/0x4000)=nil, 0x4000, 0x2, 0x8132, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)) 10:06:20 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0) ioctl$TCSETSF(r0, 0x5101, &(0x7f0000000000)) 10:06:20 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") creat(&(0x7f0000000040)='./file0\x00', 0x0) acct(&(0x7f0000000180)='./file0\x00') acct(0x0) 10:06:20 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@delneigh={0x28, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@NDA_LLADDR={0xa, 0x2, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}]}, 0x28}, 0x1}, 0x0) [ 109.049362] netlink: 3 bytes leftover after parsing attributes in process `syz-executor4'. 10:06:20 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00006dc000)=[{0x2000000000000006, 0x0, 0x0, 0xa5}]}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0x8b, 0x20000803, &(0x7f0000deaff0)={0x2, 0x4e23}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, &(0x7f0000000100), 0xfffffffffffffe96, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) readv(r0, &(0x7f00000005c0)=[{&(0x7f00000004c0)=""/101, 0x65}, {&(0x7f0000000540)=""/101, 0x65}], 0x3a) setsockopt$inet_tcp_int(r0, 0x6, 0x13, &(0x7f00000003c0), 0x4) 10:06:20 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r2 = dup2(r1, r1) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000001340)=""/4096) 10:06:20 executing program 7: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)="2e2f6367726f7570000478d081", 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000004c0)='io.weight\x00', 0x2, 0x0) read(r1, &(0x7f0000000040)=""/239, 0xef) write$cgroup_int(r1, &(0x7f0000000040), 0x1e4) [ 109.197903] Process accounting resumed [ 109.246094] Process accounting resumed [ 109.295608] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:06:21 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@delneigh={0x28, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@NDA_LLADDR={0xa, 0x2, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}]}, 0x28}, 0x1}, 0x0) 10:06:21 executing program 7: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000d300000000028000007a0a00ffffffff006b0130"], &(0x7f0000000000)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6", 0x0, 0xce, &(0x7f0000000500)=""/206}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xe, 0x5, &(0x7f0000000040)=@framed={{0x18}, [@jmp={0x5}], {0x95}}, &(0x7f0000000200)='syzkaller\x00', 0x80000001, 0x228, &(0x7f0000000300)=""/187}, 0x48) 10:06:21 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000200)='schedstat\x00') exit(0x0) sendfile(r0, r1, &(0x7f00000000c0), 0x1) 10:06:21 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f00000000c0)=0x80, 0x4) bind$inet6(r0, &(0x7f000000d000)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000040)=@dstopts, 0x8) connect$inet6(r0, &(0x7f000000cfe4)={0xa, 0x4e20}, 0x1c) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000600), 0x0, &(0x7f00000018c0)}, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") recvmsg(r0, &(0x7f0000000400)={&(0x7f0000000000)=@nfc, 0x10, &(0x7f0000000080), 0x0, &(0x7f0000000100)=""/128, 0x80}, 0x0) 10:06:21 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000044ff8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f000035d000), &(0x7f00002f4f93)}}, &(0x7f0000044000)) openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) pselect6(0x40, &(0x7f00002d2000), &(0x7f00009f3fc0)={0x7}, &(0x7f0000405fc0), &(0x7f000006a000)={0x0, 0x1c9c380}, &(0x7f00001baff0)={&(0x7f00008b3ff8), 0x8}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, r3}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 10:06:21 executing program 5: r0 = getpgid(0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x1) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000f86000)='./control/file0\x00') syz_fuse_mount(&(0x7f0000000240)='./control\x00', 0x6000, 0x0, 0x0, 0x0, 0x0) syz_fuseblk_mount(&(0x7f0000000140)='./control\x00', &(0x7f0000000180)='./control/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r1) 10:06:21 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x0) r2 = msgget(0x3, 0x44) msgctl$MSG_STAT(r2, 0xb, &(0x7f00000000c0)=""/28) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f0000000040)) r3 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0xffffffffffffff88, 0x4000) r4 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xa, 0x1012, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000140)={r4}) 10:06:21 executing program 1: r0 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$link(0x8, r0, r0) 10:06:22 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000400)='u', 0x1) tee(r2, r1, 0x1, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) [ 110.331976] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 10:06:22 executing program 4: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") clock_gettime(0x7, &(0x7f00000002c0)) 10:06:22 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f0000000180)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_RES_CTX(r0, 0x80086603, &(0x7f0000000000)={0x0, &(0x7f0000000040)}) 10:06:22 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@delneigh={0x28, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@NDA_LLADDR={0xa, 0x2, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}]}, 0x28}, 0x1}, 0x0) 10:06:22 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x0) r2 = msgget(0x3, 0x44) msgctl$MSG_STAT(r2, 0xb, &(0x7f00000000c0)=""/28) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f0000000040)) r3 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0xffffffffffffff88, 0x4000) r4 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xa, 0x1012, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000140)={r4}) 10:06:22 executing program 7: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x2) r2 = dup(r1) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) sendfile(r2, r3, &(0x7f0000000140)=0x6, 0x8000fffffffe) 10:06:22 executing program 4: r0 = socket$inet6(0xa, 0x1001000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f00000000c0)="f20f94ff0f01cf0fc72f6436f0f79b450066b9800000c00f326635000100000f3066b91a09000066b8fdafa70566ba000000000f30650fc7a900700f01cf642e3e0f005a0fb800098ee0", 0x4a}], 0x104, 0x5e, &(0x7f0000000100), 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) ioctl$KVM_RUN(r3, 0xae80, 0x0) 10:06:22 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000000780)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") ioctl$KVM_IOEVENTFD(r0, 0x6612, &(0x7f0000000040)) [ 110.715354] kvm [7983]: vcpu0, guest rIP: 0x9133 disabled perfctr wrmsr: 0xc2 data 0x5a7affd [ 110.728747] kvm [7983]: vcpu0, guest rIP: 0x9133 disabled perfctr wrmsr: 0xc2 data 0x5a7affd [ 110.741580] kvm [7983]: vcpu0, guest rIP: 0x9133 disabled perfctr wrmsr: 0xc2 data 0x5a7affd [ 110.753894] kvm [7983]: vcpu0, guest rIP: 0x9133 disabled perfctr wrmsr: 0xc2 data 0x5a7affd 10:06:26 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x0) r2 = msgget(0x3, 0x44) msgctl$MSG_STAT(r2, 0xb, &(0x7f00000000c0)=""/28) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f0000000040)) r3 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0xffffffffffffff88, 0x4000) r4 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xa, 0x1012, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000140)={r4}) 10:06:26 executing program 6: r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x8}, 0x1c) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x19) 10:06:26 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") unshare(0x400) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/qat_adf_ctl\x00', 0x0, 0x0) r1 = socket(0x10, 0x80002, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) read(r1, &(0x7f0000000100)=""/223, 0xdf) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) io_submit(r2, 0x0, &(0x7f00000002c0)) socket$vsock_stream(0x28, 0x1, 0x0) io_submit(r2, 0x2, &(0x7f0000000280)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000080), 0x8}]) 10:06:26 executing program 5: r0 = getpgid(0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x1) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000f86000)='./control/file0\x00') syz_fuse_mount(&(0x7f0000000240)='./control\x00', 0x6000, 0x0, 0x0, 0x0, 0x0) syz_fuseblk_mount(&(0x7f0000000140)='./control\x00', &(0x7f0000000180)='./control/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r1) 10:06:26 executing program 7: perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f61fe4)={0xa, 0x4e20, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket(0x40000000015, 0x5, 0x0) fstatfs(0xffffffffffffffff, &(0x7f00000004c0)=""/226) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setuid(r2) r3 = socket$inet6(0xa, 0x2, 0x0) openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000d1c000)=0x2c, 0x4) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) 10:06:26 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xc, &(0x7f0000000100)=@req3, 0x1c) 10:06:26 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@filter={'filter\x00', 0xe, 0x3, 0x440, [0x0, 0x20000ac0, 0x20000af0, 0x20000df8], 0x0, &(0x7f0000000000), &(0x7f0000000ac0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x5, 0x0, 0x0, 'ipddp0\x00', 'veth0_to_bond\x00', 'vlan0\x00', 'veth1_to_bond\x00', @random="ace8561696d6", [], @link_local={0x1, 0x80, 0xc2}, [], 0x120, 0x120, 0x150, [@rateest={'rateest\x00', 0x48, {{'ipddp0\x00', 'erspan0\x00', 0x4}}}, @statistic={'statistic\x00', 0x18}]}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}, {{{0x11, 0x0, 0x0, 'dummy0\x00', 'team0\x00', 'syz_tun\x00', 'veth1_to_bond\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @empty, [], 0xd8, 0x158, 0x188, [@cgroup0={'cgroup\x00', 0x8}, @cluster={'cluster\x00', 0x10}]}, [@common=@dnat={'dnat\x00', 0x10, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}]}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x9, 0x0, 0x0, 'dummy0\x00', 'bcsf0\x00', 'bridge_slave_1\x00', 'eql\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @random="237d1fe7bbb6", [], 0x70, 0xa0, 0xd8}, [@common=@CONNSECMARK={'CONNSECMARK\x00', 0x8}]}, @common=@mark={'mark\x00', 0x10}}]}]}, 0x4b8) 10:06:26 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000400)='u', 0x1) tee(r2, r1, 0x1, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) 10:06:27 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000100)="0047fc2f07d82c99240970") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x14, &(0x7f0000000000)=ANY=[], 0x0) close(r2) close(r1) 10:06:27 executing program 6: r0 = socket(0xa, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f00000003c0)="c626262c8523bf012cf66f") r1 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000040)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f00000000c0)={0x25, @time}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f00000001c0)={0xfffffffffffffffc, 0x0, 'client1\x00', 0x0, "0e283b387b7ee401", "fc82a0ff4014678bc4a63b1756ae3546914aae2a9b3b49988df5df01f83de7e6"}) close(r1) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) 10:06:27 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getcwd(&(0x7f0000000000)=""/207, 0xcf) 10:06:27 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x0) r2 = msgget(0x3, 0x44) msgctl$MSG_STAT(r2, 0xb, &(0x7f00000000c0)=""/28) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f0000000040)) r3 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0xffffffffffffff88, 0x4000) r4 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xa, 0x1012, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000140)={r4}) 10:06:27 executing program 7: syz_mount_image$reiserfs(&(0x7f0000000240)='reiserfs\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x0, &(0x7f0000003680), 0x0, &(0x7f0000000480)={[{@commit={'commit', 0x3d, [0x3f]}, 0x2c}]}) 10:06:27 executing program 0: capset(&(0x7f0000000000)={0x19980330}, &(0x7f00000000c0)) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xf}, 0x2c) 10:06:27 executing program 3: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) r1 = add_key$keyring(&(0x7f0000000500)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) r2 = add_key$user(&(0x7f0000ef5000)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a}, &(0x7f0000000380)="01df9dfeca3e4a66fa10d4b994da0ff31d5102902133b2e40dcd6be19bf3c2cf1724da2af35e4aa241b08e6f566dd18cd13d7ce4a0fbde4eeb175e53533d1f4e61fde71d07b224c9e94d4029195e63991675941708381967a1f0b7a2519f17aa4cadfd1453d04ee3fc1c0bd945eddf5985aab711fdea0839c8471d17254721732197709e9d2c850625", 0x89, r0) r3 = add_key$user(&(0x7f0000688000)='user\x00', &(0x7f0000000800)={0x73, 0x79, 0x7a}, &(0x7f00000001c0)="b33ab76079ebe0d14f729cd653e520d29ad7ef0000000000000044c249b544230b9387fb8bd6ed266ccf59ef70995bf2e8e2ecd3fff32853747eda22d29be9b36119ec53dc60e2c80b3e9ffa1b81a808ca27e0ec821620e365a0e6b9485f2d925493f62113e33e5f8c7eba67fc19a9497f5b07e5849d2e875b06876e56aaa5616fe0f3c3002801b4627ee75976895c5eba5a3c39fd0ab4932510525e8e81f750a8020080fb46c1523b8a25e71690ea52246bd3d32b1a91f944edb74b1f50ae08c288c16a81334689ffa1a995fefa7ebc1b0d911cc241ed814ba80fe4d6a505d75a180b271d24be4002e46f019fe4a2e9b437008a86821f98daad18b14068070f8fa3243f1828d2cd57", 0x109, r1) r4 = request_key(&(0x7f0000a98ffb)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f0000dde000)="2f6465612f7675746f66730719", 0x0) keyctl$dh_compute(0x17, &(0x7f0000000080)={r2, r3, r4}, &(0x7f00005cd000), 0x0, &(0x7f000010c000)={&(0x7f0000bf4ff3)={'ghash-generic\x00'}, &(0x7f0000000000)}) [ 115.631617] REISERFS warning (device loop7): super-6508 reiserfs_parse_options: bad value ? for -ocommit [ 115.631617] [ 115.663706] REISERFS warning (device loop7): super-6508 reiserfs_parse_options: bad value ? for -ocommit [ 115.663706] 10:06:28 executing program 7: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) r1 = socket(0x40000000002, 0x3, 0x2) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000100)=0x80, 0x4) sendto$unix(r1, &(0x7f0000000000)="28621af481f61fcea405792398332011020ba4d2c71c416bb5e2e4fb758acd04", 0x20, 0x0, &(0x7f0000000140)=@abs, 0x6e) 10:06:28 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000bba000)={&(0x7f00003a2000)=@abs, 0x8, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x18, 0x1, 0x1, [r1]}], 0x18}, 0x0) sendmsg$unix(r2, &(0x7f0000e4ffc8)={&(0x7f0000beb000)=@abs, 0x8, &(0x7f000000d000), 0x0, &(0x7f000053c000)=[@rights={0x18, 0x1, 0x1, [r2]}], 0x18}, 0x0) r4 = socket(0xa, 0x80002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") dup2(r3, r1) close(r2) close(r0) 10:06:28 executing program 3: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040), 0x4) 10:06:28 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x8, &(0x7f0000000040)=0xfffffffffffffffd, 0x4) r1 = dup2(r0, r0) getsockopt$inet6_tcp_int(r1, 0x6, 0x8, &(0x7f0000000100), &(0x7f0000000140)=0x4) 10:06:28 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000400)='u', 0x1) tee(r2, r1, 0x1, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) 10:06:28 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x400000, 0x0) ioprio_set$pid(0x2, 0x0, 0x4001) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)) clone(0x0, &(0x7f0000000240), &(0x7f0000000380), &(0x7f00000001c0), &(0x7f0000000300)) 10:06:28 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$setperm(0x5, r1, 0x0) keyctl$get_security(0x6, r1, &(0x7f0000000000)=""/114, 0x72) 10:06:28 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) fcntl$setstatus(r0, 0x4, 0x40000000042c00) sendto$inet(r0, &(0x7f0000a88f88), 0x332, 0x20000800, &(0x7f0000e68000)={0x2}, 0x10) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0) [ 116.521328] raw_sendmsg: syz-executor7 forgot to set AF_INET. Fix it! 10:06:28 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000389000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x3, 0x2) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f00000001c0)) ioctl$VHOST_RESET_OWNER(0xffffffffffffffff, 0xaf02, 0x0) 10:06:28 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') getdents64(r0, &(0x7f0000000380)=""/4096, 0x1000) exit(0x0) getdents64(r0, &(0x7f0000000340)=""/57, 0x18) 10:06:28 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000bba000)={&(0x7f00003a2000)=@abs, 0x8, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x18, 0x1, 0x1, [r1]}], 0x18}, 0x0) sendmsg$unix(r2, &(0x7f0000e4ffc8)={&(0x7f0000beb000)=@abs, 0x8, &(0x7f000000d000), 0x0, &(0x7f000053c000)=[@rights={0x18, 0x1, 0x1, [r2]}], 0x18}, 0x0) r4 = socket(0xa, 0x80002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") dup2(r3, r1) close(r2) close(r0) 10:06:28 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$assume_authority(0x10, 0x0) exit(0x0) close(r1) 10:06:28 executing program 6: r0 = socket(0x10, 0x4000000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'veth1_to_bond\x00', &(0x7f0000000100)=@ethtool_gstrings={0x1b}}) 10:06:28 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x7, 0x4) 10:06:28 executing program 2: r0 = socket$kcm(0x29, 0x200000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000100)="0042fc2f07d82c99240970") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000000)={0x3f, 0x7, 0x7}, 0xc) close(r2) close(r1) 10:06:28 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000bba000)={&(0x7f00003a2000)=@abs, 0x8, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x18, 0x1, 0x1, [r1]}], 0x18}, 0x0) sendmsg$unix(r2, &(0x7f0000e4ffc8)={&(0x7f0000beb000)=@abs, 0x8, &(0x7f000000d000), 0x0, &(0x7f000053c000)=[@rights={0x18, 0x1, 0x1, [r2]}], 0x18}, 0x0) r4 = socket(0xa, 0x80002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") dup2(r3, r1) close(r2) close(r0) 10:06:28 executing program 7: r0 = socket(0x15, 0x80005, 0x0) socket$rds(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2716, &(0x7f00000002c0)=""/1, &(0x7f0000000000)=0x1b4) 10:06:28 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f00000002c0)={0x1c, 0x1a, 0x201, 0x0, 0x0, {}, [@typed={0x8, 0x0, @u32=0xffffffff}]}, 0x1c}, 0x1}, 0x0) 10:06:29 executing program 3: socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000340), &(0x7f0000000080)}, 0x20) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f0, &(0x7f0000000300)='gre0\x00') bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000000)="ac287e65126d12320180107348599fa77a40b2c7ed7c5378af6858cb8b1678fd02eff20455fb3d3a6ab04b2b87b6d1132195878b401949b99d1080896eb42743abcb4db474c49926f1e4b495c778a9e82d7c8aed8dd0f7de900a69b89aadf9411d4fe0ba0a4b3caa589bd4d74fa3950411c21bfa7d9c3ec625df410b54b74e970938a6537f01c05ab243486e170cda669624c56d6d", &(0x7f0000000780)}, 0x20) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f3, &(0x7f0000000300)='gre0\x00') 10:06:29 executing program 7: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x19, &(0x7f00003b9ffc)=0x40000100000800, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000469ffc)=0x7fe, 0x4) sendto$inet(r0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)={0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) recvfrom$inet(r0, &(0x7f00000002c0)=""/248, 0xf8, 0x2002, 0x0, 0x86) 10:06:29 executing program 6: r0 = socket(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000100)={'veth1_to_team\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="00f1ff00000000000000000000000000000000000000a307"]}) setsockopt$inet_int(r0, 0x0, 0x40, &(0x7f0000000080), 0x1) 10:06:29 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000bba000)={&(0x7f00003a2000)=@abs, 0x8, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x18, 0x1, 0x1, [r1]}], 0x18}, 0x0) sendmsg$unix(r2, &(0x7f0000e4ffc8)={&(0x7f0000beb000)=@abs, 0x8, &(0x7f000000d000), 0x0, &(0x7f000053c000)=[@rights={0x18, 0x1, 0x1, [r2]}], 0x18}, 0x0) r4 = socket(0xa, 0x80002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") dup2(r3, r1) close(r2) close(r0) 10:06:29 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000580)={0x0, @broadcast, @multicast1}, &(0x7f00000005c0)=0x3) 10:06:29 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000400)='u', 0x1) tee(r2, r1, 0x1, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) 10:06:29 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000340)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='\'\x00', 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, "804e2486cff9d9266b6504d1017e922724e09f8a6d2cec6c5249cf42d85e7f102204bb458c81a116e92825862da340dec9ee4a6bb74e77d3dd1a52f33cc1748d", "9b0fcdf54d8916989d63700e3a6899a829b385286943b044bf2cf8bdf5c1d14998d5bbac6c4deae26bc26c30222a2d0b5150e643db0873477ebc926e82d8fccc", "73e37038ac9e1afce8d30c230037155d045737cfaa8dd98f8db0f64fe0594b51"}) 10:06:29 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x200000088) connect$inet6(r0, &(0x7f0000000280)={0xa}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f000072eff0)=[{&(0x7f00000000c0)="480000001400257f09004b01fcfc8c860a881700f217e0060000e30000e5ffffbb5603000000000000000000ffff5bf109000000ed5e000000006203005b00000000000000000000", 0x48}], 0x1) 10:06:29 executing program 6: r0 = socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x19, &(0x7f0000000380), 0x4) sendmsg$kcm(r0, &(0x7f0000000300)={&(0x7f0000000480)=@in6={0xa, 0x4e22, 0x0, @loopback={0x0, 0x1}}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000000680)}, 0x0) recvmsg(r0, &(0x7f000000c440)={&(0x7f000000c200)=@hci, 0x80, &(0x7f000000c400)}, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000000)=@in={0xa, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x80, &(0x7f0000000080), 0x0, &(0x7f0000000140)}, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000500)=""/219, 0xdb}, 0x2020) 10:06:29 executing program 4: r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6}]}) r1 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) 10:06:29 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip6_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000040)=0xf0, 0x80000002) 10:06:29 executing program 7: syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010a0200027400f801", 0x17}], 0x0, &(0x7f0000000040)) syz_fuseblk_mount(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0/\\ile0"\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 10:06:29 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106-gcm-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, &(0x7f0000000580), 0x10) 10:06:29 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @broadcast}}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000d40)=""/4096, 0xffd2}], 0x1, &(0x7f0000000080)=""/92, 0xfffffffffffffe56}, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000100)=0x1, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x34, 0x0) ioctl$int_out(r1, 0xc0305710, &(0x7f0000000100)) 10:06:29 executing program 3: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") syz_mount_image$xfs(&(0x7f0000000300)='xfs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x0, &(0x7f0000000640), 0x0, &(0x7f00000006c0)={'nouuid,', {[{@dax='dax', 0x2c}, {@sunit={'sunit', 0x3d, [0x36, 0x0]}, 0x2c}]}}) 10:06:29 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x8000000002, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='pagemap\x00') sendfile(r0, r1, &(0x7f0000493000), 0xfffffffd) [ 118.066973] FAT-fs (loop7): Directory bread(block 2563) failed [ 118.091874] FAT-fs (loop7): Directory bread(block 2564) failed [ 118.101584] XFS (loop3): sunit and swidth must be specified together 10:06:29 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r0, &(0x7f0000002b00)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000002ac0)={0xffffffff}, 0x106}}, 0x20) write$rdma_cm(r0, &(0x7f0000000280)=@resolve_ip={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, {0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, r1}}, 0x48) write$rdma_cm(r0, &(0x7f0000000140)=@bind={0x14, 0x88, 0xfa00, {0xffffffff, 0x30, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0xcc2}}}, 0x90) write$rdma_cm(r0, &(0x7f0000000100)=@destroy_id={0x1, 0x10, 0xfa00, {&(0x7f0000000080), r1}}, 0x18) write$rdma_cm(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0x0) [ 118.136238] FAT-fs (loop7): Directory bread(block 2565) failed [ 118.157638] XFS (loop3): sunit and swidth must be specified together [ 118.174084] FAT-fs (loop7): Directory bread(block 2566) failed 10:06:29 executing program 0: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000380)={{{@in, @in=@dev={0xac, 0x14, 0x14}, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local={0xac, 0x14, 0x14, 0xaa}, 0x0, 0x32}, 0x0, @in6, 0x0, 0x4}}, 0xe8) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xd}}, 0x10) 10:06:29 executing program 6: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000, 0x80000ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f000091dff8)='./file0\x00', &(0x7f0000343ff8)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) 10:06:29 executing program 4: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) readv(r1, &(0x7f0000000540)=[{&(0x7f00000001c0)}, {&(0x7f0000000200)=""/62, 0x3e}], 0x2) 10:06:29 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f0000000000)) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000080)) [ 118.193423] FAT-fs (loop7): Directory bread(block 2567) failed [ 118.219425] FAT-fs (loop7): Directory bread(block 2568) failed [ 118.233486] FAT-fs (loop7): Directory bread(block 2569) failed [ 118.241944] FAT-fs (loop7): Directory bread(block 2570) failed [ 118.254809] FAT-fs (loop7): Directory bread(block 2571) failed [ 118.267472] FAT-fs (loop7): Directory bread(block 2572) failed 10:06:30 executing program 7: r0 = syz_open_dev$sndctrl(&(0x7f0000000d00)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = socket$kcm(0x29, 0x80000400000002, 0x0) ioctl(r1, 0x200008912, &(0x7f0000000000)="0047fc2f07d82c99240970") socket$inet(0x10, 0x0, 0x0) semctl$SEM_INFO(0x0, 0x1, 0x13, &(0x7f0000000000)=""/18) perf_event_open(&(0x7f0000001000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000005000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc0405519, &(0x7f0000001000)) 10:06:30 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r0, &(0x7f0000002b00)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000002ac0)={0xffffffff}, 0x106}}, 0x20) write$rdma_cm(r0, &(0x7f0000000280)=@resolve_ip={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, {0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, r1}}, 0x48) write$rdma_cm(r0, &(0x7f0000000140)=@bind={0x14, 0x88, 0xfa00, {0xffffffff, 0x30, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0xcc2}}}, 0x90) write$rdma_cm(r0, &(0x7f0000000100)=@destroy_id={0x1, 0x10, 0xfa00, {&(0x7f0000000080), r1}}, 0x18) write$rdma_cm(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0x0) 10:06:30 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$packet(0x11, 0x2, 0x300) sendto$inet(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0, &(0x7f0000000000)={0x2}, 0x10) getsockopt$packet_int(r1, 0x107, 0xb, &(0x7f0000000000), &(0x7f00000003c0)=0x5a) 10:06:30 executing program 6: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xb, 0x7f, 0x7, 0x5, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r0, &(0x7f0000000040)}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x3}, 0x13) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r0, &(0x7f0000000180), &(0x7f0000000300)}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000200)={r0, &(0x7f0000000180)}, 0x10) 10:06:30 executing program 3: r0 = socket$kcm(0x29, 0x80000400000002, 0x0) ioctl(r0, 0x200008912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = syz_open_dev$sndpcmc(&(0x7f0000004fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) fstat(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6a, &(0x7f000000d000), 0x0, &(0x7f0000001ef8)=[@cred={0x20, 0x1, 0x2}, @cred={0x20, 0x1, 0x2}, @cred={0x20, 0x1, 0x2}, @rights={0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, @cred={0x20, 0x1, 0x2, 0x0, 0x0, r3}], 0xa0}], 0x1, 0x0) ioctl$KVM_S390_INTERRUPT_CPU(0xffffffffffffffff, 0x4010ae94, &(0x7f0000002000)={0x0, 0x13}) ioctl(r1, 0xc1004110, &(0x7f0000001f64)) 10:06:30 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='#em1#+\x00', 0x0) write(r0, &(0x7f0000000380)="0638ef5df8aaf5c6", 0x8) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) 10:06:30 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000100)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast2=0xe0000002, @in=@rand_addr}, {@in6=@ipv4={[0xfffffff0], [0xff, 0xff], @broadcast=0xffffffff}, 0x0, 0x32}, @in6=@ipv4={[], [0xff, 0xff]}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1}, 0x0) 10:06:30 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106-gcm-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, &(0x7f0000000580), 0x10) 10:06:30 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106-gcm-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, &(0x7f0000000580), 0x10) 10:06:30 executing program 3: mkdir(&(0x7f0000000140)='./0ile/\x00', 0x0) getxattr(&(0x7f0000000040)='./0ile/\x00', &(0x7f0000000180)=@known='system.posix_acl_default\x00', &(0x7f00000001c0)=""/23, 0x17) 10:06:30 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r0, &(0x7f0000002b00)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000002ac0)={0xffffffff}, 0x106}}, 0x20) write$rdma_cm(r0, &(0x7f0000000280)=@resolve_ip={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, {0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, r1}}, 0x48) write$rdma_cm(r0, &(0x7f0000000140)=@bind={0x14, 0x88, 0xfa00, {0xffffffff, 0x30, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0xcc2}}}, 0x90) write$rdma_cm(r0, &(0x7f0000000100)=@destroy_id={0x1, 0x10, 0xfa00, {&(0x7f0000000080), r1}}, 0x18) write$rdma_cm(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0x0) 10:06:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r3, 0x0, 0x2, r2}) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4, 0xfffffffffffffffb, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r2}) 10:06:30 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r0, 0x29, 0x43, &(0x7f0000000000), &(0x7f0000000040)=0x4) 10:06:30 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$inet(0x2, 0x3, 0x20000000084) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x83, &(0x7f0000001200)={'nat\x00', 0x0, 0x0, 0x90, [], 0x1000000000000032, &(0x7f00000001c0), &(0x7f0000000200)=""/4096}, &(0x7f0000001280)=0x108) 10:06:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000100)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast2=0xe0000002, @in=@rand_addr}, {@in6=@ipv4={[0xfffffff0], [0xff, 0xff], @broadcast=0xffffffff}, 0x0, 0x32}, @in6=@ipv4={[], [0xff, 0xff]}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1}, 0x0) 10:06:31 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='#em1#+\x00', 0x0) write(r0, &(0x7f0000000380)="0638ef5df8aaf5c6", 0x8) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) 10:06:31 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106-gcm-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, &(0x7f0000000580), 0x10) 10:06:31 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r2 = dup3(r0, r1, 0x0) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000001, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x8) 10:06:31 executing program 6: r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f00000003c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=@ipv6_delrule={0x48, 0x21, 0x11, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10015}, [@FRA_DST={0x14, 0x1, @ipv4={[], [0xff, 0xff], @rand_addr}}, @FRA_DST={0x14, 0x18, @local={0xfe, 0x80, [], 0xaa}}]}, 0x48}, 0x1}, 0x0) 10:06:31 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r0, &(0x7f0000002b00)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000002ac0)={0xffffffff}, 0x106}}, 0x20) write$rdma_cm(r0, &(0x7f0000000280)=@resolve_ip={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, {0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, r1}}, 0x48) write$rdma_cm(r0, &(0x7f0000000140)=@bind={0x14, 0x88, 0xfa00, {0xffffffff, 0x30, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0xcc2}}}, 0x90) write$rdma_cm(r0, &(0x7f0000000100)=@destroy_id={0x1, 0x10, 0xfa00, {&(0x7f0000000080), r1}}, 0x18) write$rdma_cm(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0x0) 10:06:31 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0xe, 0x4, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, [0x5f, 0x4b]}, 0x2c) 10:06:31 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000180)="0000000000000000fe000000000000000000000000300000e0e5153200bb53000200880126000100000064000000000127008e030c00650000006423000000030d00f0043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) [ 119.445454] kernel msg: ebtables bug: please report to author: Num_counters wrong [ 119.475866] irq bypass consumer (token 00000000421559a3) registration fails: -16 10:06:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000100)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast2=0xe0000002, @in=@rand_addr}, {@in6=@ipv4={[0xfffffff0], [0xff, 0xff], @broadcast=0xffffffff}, 0x0, 0x32}, @in6=@ipv4={[], [0xff, 0xff]}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1}, 0x0) 10:06:31 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='#em1#+\x00', 0x0) write(r0, &(0x7f0000000380)="0638ef5df8aaf5c6", 0x8) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) 10:06:31 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r0 = socket$inet(0x10, 0x3, 0x100000009) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000002000)="24000000530407031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) 10:06:31 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(r0, &(0x7f0000001780)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000001740)={0xffffffff}, 0x13f}}, 0x20) write$rdma_cm(r0, &(0x7f00000017c0)=@bind_ip={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, r1}}, 0x30) write$rdma_cm(r0, &(0x7f0000000000)=@listen={0x7, 0x8, 0xfa00, {r1}}, 0x10) r2 = socket$unix(0x1, 0x5, 0x0) dup3(r2, r0, 0x0) 10:06:31 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl=@kern={0x10}, 0x80, &(0x7f0000002000)=[{&(0x7f000000dfaa)="5500000018007f5300fe01b2a4a280930a06000000a8430891000000390008000a000c00060000001900a30704000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab91d4", 0x55}], 0x1, &(0x7f0000000400)}, 0x0) 10:06:31 executing program 6: socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffffff) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000340)='\x00') 10:06:31 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_mtu(r1, 0x0, 0x16, &(0x7f0000000000), 0x4) [ 119.681250] Dev loop7: unable to read RDB block 1 [ 119.686384] loop7: unable to read partition table [ 119.735141] loop7: partition table beyond EOD, truncated [ 119.740799] loop_reread_partitions: partition scan of loop7 () failed (rc=-5) 10:06:31 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='#em1#+\x00', 0x0) write(r0, &(0x7f0000000380)="0638ef5df8aaf5c6", 0x8) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) [ 119.819228] audit: type=1107 audit(1528365991.445:3): pid=8351 uid=0 auid=4294967295 ses=4294967295 msg=' [ 119.819228] ' [ 119.877814] Dev loop7: unable to read RDB block 1 [ 119.882796] loop7: unable to read partition table [ 119.903400] audit: type=1107 audit(1528365991.474:4): pid=8351 uid=0 auid=4294967295 ses=4294967295 msg=' [ 119.903400] ' [ 119.919252] loop7: partition table beyond EOD, truncated [ 119.924982] loop_reread_partitions: partition scan of loop7 () failed (rc=-5) 10:06:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000240)) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={&(0x7f0000000100)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast2=0xe0000002, @in=@rand_addr}, {@in6=@ipv4={[0xfffffff0], [0xff, 0xff], @broadcast=0xffffffff}, 0x0, 0x32}, @in6=@ipv4={[], [0xff, 0xff]}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1}, 0x0) 10:06:31 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$unix(0x1, 0x1000000002, 0x0) r2 = socket$unix(0x1, 0x10000000002, 0x0) bind$unix(r2, &(0x7f0000003000)=@abs={0x1}, 0x8) connect(r1, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) write$binfmt_script(r1, &(0x7f0000000000)=ANY=[], 0x0) r3 = dup3(r2, r1, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f00000000c0)) 10:06:31 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000001340)=[{&(0x7f00000000c0)="ed20291de807f750874bc4854d6c17b6f27d41628a29685c7a5cb79c32fd2dfdbbcfc7a3188081206480dab39d2e676304da102ac1db2603f0bc7a83b30f6b7d9801aec6ebcd65c1abc43d9a3fb7edad72f5023b19eb5606747e4a2639d1eaf28621bd00e600092dca9de4ba296ef7a8541d0b106f71e51aa04211ba3908be3dd018b52a31b9f34a8f43bc73d7a1ffed1bc3b0110820f963af594e1b40ee4f6e5f6d15d8afb3fb0821d1171552cda73ae19f961702ccef0bdfbd38bb290b59b9ffd1b2a8f49c3958f0aa6cf87545b779404e25eb50c4f67af66531cbcc08067d8ef7bef9b72ee3eedc0408ef2720f1625cab7befec439368ebe086ba043725ef56e160ac49265cee30e670b81dcffa0a80d41f4ce9e51646c2e0ddbbde367569f708a74b2602d6de39ca35abafcd90ab8d8f753fc8ca99710a0a4b9c1592bc7dea6231918993b8f60abcc098da68fb9f849060294d7214bdbaee766bf03590c89ebbe47f0e17960fe1b394fc6b246e25e932ceb4aaddceba1c27480aad7dfb28d232292b560f6933a5caf0a14304ea6da699ddc0c2487efc0231f76c5252fd1c5ee2e0f8c160a7ca3f613808658d6e4e6eac550e05754efec0d87af6acdbbb4bedce7d20c2b5d25077a60579787348998f83d6f11277ac816c5d374b68a92a991439e8d76440131691e9f08361ecf813fa718d3457e00f4899ccb8b56f432018e83a1711f5b7cd018aea8976aae67e4818795f6328eee6fb13c73015792c00f757afab815bbfe73bcb9106c8acd769e2629096f95a1c515205104749baae4896551081a3a5c4d5f7f5aa03ab33ce2e8a5919cb6725ccc610e78569758eb48be9c0adad493144c29c087f73c3d807eb8245df1e6fa87773106c984fc6f998222af4b0d6e6352cfe323b", 0x289}], 0x1}, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000080)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000040)={{0x1}}) clone(0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x40505412, &(0x7f0000000340)=""/4096) 10:06:31 executing program 4: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="c626262c8523bf012cf66f") syz_mount_image$hfs(&(0x7f0000000280)='hfs\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x0, &(0x7f0000002880), 0x0, &(0x7f0000002940)={[{@file_umask={'file_umask', 0x3d, [0x32]}, 0x2c}, {@type={'type', 0x3d, "c6ecb242"}, 0x2c}]}) syz_open_dev$vcsn(&(0x7f0000002a40)='/dev/vcs#\x00', 0x0, 0x0) 10:06:31 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) write$rdma_cm(r0, &(0x7f0000000640)=@get_event={0xc, 0x8, 0xfa00, {&(0x7f00000004c0)}}, 0x10) close(r0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl(r2, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") tkill(r1, 0x1000000000016) 10:06:31 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="044ef5"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000), 0x1000000000000040) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:31 executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) shutdown(r0, 0x0) 10:06:31 executing program 6: socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffffff) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000340)='\x00') [ 120.120324] hfs: can't find a HFS filesystem on dev loop4 10:06:31 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffffff) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000340)='\x00') 10:06:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[]}, 0x1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={&(0x7f0000000080)={0x10}, 0x0, &(0x7f00000008c0)={&(0x7f0000000dc0)=@gettaction={0x18, 0x30, 0x5, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x4, 0x1}]}, 0x18}, 0x1}, 0x0) 10:06:31 executing program 6: socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffffff) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000340)='\x00') [ 120.206561] hfs: can't find a HFS filesystem on dev loop4 10:06:31 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x8b000)=nil, 0x8b000, 0x1000004, 0x10000032, 0xffffffffffffffff, 0x0) futex(&(0x7f0000001000), 0x8c, 0x1, &(0x7f0000191000), &(0x7f0000000000), 0x0) 10:06:31 executing program 4: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="c626262c8523bf012cf66f") syz_mount_image$hfs(&(0x7f0000000280)='hfs\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x0, &(0x7f0000002880), 0x0, &(0x7f0000002940)={[{@file_umask={'file_umask', 0x3d, [0x32]}, 0x2c}, {@type={'type', 0x3d, "c6ecb242"}, 0x2c}]}) syz_open_dev$vcsn(&(0x7f0000002a40)='/dev/vcs#\x00', 0x0, 0x0) 10:06:32 executing program 2: r0 = getpgid(0x0) sched_setattr(r0, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000001c0)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000f86000)='./control/file0\x00') rmdir(&(0x7f00000000c0)='./control\x00') umount2(&(0x7f0000000500)='./file0\x00', 0x0) mknod(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) close(r1) 10:06:32 executing program 0: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000004580)) [ 120.426273] hfs: can't find a HFS filesystem on dev loop4 10:06:33 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffffff) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000340)='\x00') 10:06:33 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[]}, 0x1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={&(0x7f0000000080)={0x10}, 0x0, &(0x7f00000008c0)={&(0x7f0000000dc0)=@gettaction={0x18, 0x30, 0x5, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x4, 0x1}]}, 0x18}, 0x1}, 0x0) 10:06:33 executing program 6: socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffffff) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000340)='\x00') 10:06:33 executing program 0: syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x1, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=0x3000000, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, @local={0xac, 0x14, 0x14, 0xaa}}}}}, &(0x7f0000000100)) 10:06:33 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000002c0)=@ioapic={0x1, 0xfdfdffff, 0x0, 0x0, 0x80ffff}) 10:06:33 executing program 4: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="c626262c8523bf012cf66f") syz_mount_image$hfs(&(0x7f0000000280)='hfs\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x0, &(0x7f0000002880), 0x0, &(0x7f0000002940)={[{@file_umask={'file_umask', 0x3d, [0x32]}, 0x2c}, {@type={'type', 0x3d, "c6ecb242"}, 0x2c}]}) syz_open_dev$vcsn(&(0x7f0000002a40)='/dev/vcs#\x00', 0x0, 0x0) 10:06:33 executing program 5: r0 = socket(0x40000000015, 0x805, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000200)={'sit0\x00', &(0x7f00000001c0)=@ethtool_rxfh={0x47, 0x0, 0x0, 0x0, 0x0, "721f33"}}) 10:06:33 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='bridge_slave_0\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x400000000032, &(0x7f0000000040)=0x1000000, 0x4) 10:06:33 executing program 0: r0 = add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) open$dir(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, r1) r3 = socket(0xa, 0x1, 0x0) ioctl(r3, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000480)="620822455bef493632b8356e98bec15ab7efb1b1574c8551df1cf824fcf408366818f3799b8fd414957beab660fc200a74da3cc7bc9eccfd03dbed6e", 0x3c) r4 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000000)={0x73, 0x79, 0x7a}, 0x0, 0x0, r2) getsockname$ipx(0xffffffffffffffff, &(0x7f0000000280), &(0x7f00000002c0)=0x10) r5 = add_key$user(&(0x7f00003bd000)='user\x00', &(0x7f0000000b00)={0x73, 0x79, 0x7a}, &(0x7f00000000c0)="7f", 0x1, r4) r6 = add_key$user(&(0x7f0000002cc0)='user\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a}, &(0x7f0000000280), 0x23e, r0) keyctl$dh_compute(0x17, &(0x7f0000000340)={r5, r6, r6}, &(0x7f0000000600)=""/132, 0xffffffffffffff98, 0x0) 10:06:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000580), 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x486, 0x0, 0x80000021}]}) [ 121.525405] hfs: can't find a HFS filesystem on dev loop4 10:06:33 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x20000000802, 0x0) write(r0, &(0x7f0000000000)="240000001a0025f00018000400edfc0e8000000000000000000000000800010048050000", 0x24) 10:06:33 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffffff) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000340)='\x00') 10:06:33 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[]}, 0x1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={&(0x7f0000000080)={0x10}, 0x0, &(0x7f00000008c0)={&(0x7f0000000dc0)=@gettaction={0x18, 0x30, 0x5, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x4, 0x1}]}, 0x18}, 0x1}, 0x0) 10:06:33 executing program 4: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="c626262c8523bf012cf66f") syz_mount_image$hfs(&(0x7f0000000280)='hfs\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x0, &(0x7f0000002880), 0x0, &(0x7f0000002940)={[{@file_umask={'file_umask', 0x3d, [0x32]}, 0x2c}, {@type={'type', 0x3d, "c6ecb242"}, 0x2c}]}) syz_open_dev$vcsn(&(0x7f0000002a40)='/dev/vcs#\x00', 0x0, 0x0) 10:06:33 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000002c0)=@ioapic={0x1, 0xfdfdffff, 0x0, 0x0, 0x80ffff}) 10:06:33 executing program 2: socket$inet_dccp(0x2, 0x6, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x7fffffff, &(0x7f0000000000)="0153d8c5e82fa81f8131d606d36e9d96e7b2384c75adf6a73fc8bf8ce162299640e4bafe4d4a08f5e4b04ea5742a9a") r1 = socket(0xa, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000000c0)=0xe8e4c63139dc30ea) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000180)={0x11, @broadcast=0xffffffff, 0x4e21, 0x3, 'lblc\x00', 0x0, 0x0, 0xfffffffffffffffe}, 0x2c) 10:06:33 executing program 2: r0 = syz_init_net_socket$bt_sco(0x1f, 0x3, 0x6) r1 = dup(r0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000100)="0047fc2f07d82c99240970") ioctl$VHOST_SET_VRING_KICK(r1, 0x800448d2, &(0x7f0000000000)={0x1}) [ 121.801178] hfs: can't find a HFS filesystem on dev loop4 10:06:33 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000080)=ANY=[@ANYBLOB="e794bf52c081552bd866c9d36a9c400000ffce9443cb"], &(0x7f0000000340)=0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pipe2(&(0x7f0000000000), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:33 executing program 6: r0 = socket$inet(0x2, 0x6, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) getsockopt$inet_mreqsrc(r0, 0x10d, 0xc, &(0x7f0000000080)={@dev, @local, @broadcast}, &(0x7f0000005800)=0xc) 10:06:33 executing program 0: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = socket$kcm(0x29, 0x2, 0x0) chmod(&(0x7f0000000140)='./file0/file0\x00', 0x0) ioctl(r0, 0x8912, &(0x7f00000001c0)="0047fc2f07d82c99240970") open(&(0x7f00000000c0)='./file0/file0\x00', 0x3fffa, 0x0) 10:06:33 executing program 5: r0 = socket$kcm(0x29, 0x80000400000002, 0x0) ioctl(r0, 0x200008912, &(0x7f0000000000)="0047fc2f07d82c99240970") clone(0x0, &(0x7f0000000140), &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000400)=""/246) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f0000000000)=0x600210) r2 = gettid() readv(r1, &(0x7f00000006c0)=[{&(0x7f0000000600)=""/145, 0x91}], 0x1) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) pwritev(r1, &(0x7f0000161000)=[{&(0x7f0000000040)="f5", 0x1}], 0x1, 0x0) 10:06:33 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000002c0)=@ioapic={0x1, 0xfdfdffff, 0x0, 0x0, 0x80ffff}) 10:06:33 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x0, 0xfffffffffffffff7}, 0x10) sendmsg$netlink(r2, &(0x7f00003aefc8)={0x0, 0xffffffffffffff73, &(0x7f0000847000), 0x1f2, &(0x7f000048a000)}, 0x0) sendmmsg$alg(r2, &(0x7f0000004ac0)=[{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000001340)='\a', 0x1}], 0x1}], 0x1, 0x0) close(r2) mmap(&(0x7f0000000000/0xd25000)=nil, 0xd25000, 0x0, 0x32, 0xffffffffffffffff, 0x0) close(r1) 10:06:33 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r0, 0x3a, 0x0, &(0x7f0000000280), &(0x7f00000002c0)=0x4) 10:06:33 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[]}, 0x1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={&(0x7f0000000080)={0x10}, 0x0, &(0x7f00000008c0)={&(0x7f0000000dc0)=@gettaction={0x18, 0x30, 0x5, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x4, 0x1}]}, 0x18}, 0x1}, 0x0) 10:06:33 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000580)=[{&(0x7f00000004c0)="04", 0x1}], 0x1) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970") write(r0, &(0x7f0000fa8000)="2300000014000707030e0000120f0a0809bcb1dfdf004511000100f5fe0012ff000000", 0x23) 10:06:33 executing program 0: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x6013, r0, 0x81000000) 10:06:33 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x54, 0x0, &(0x7f0000000180)=[@clear_death={0x400c630f}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140)}}], 0x0, 0x0, &(0x7f0000000280)}) 10:06:33 executing program 1: r0 = semget$private(0x0, 0x2, 0x0) semop(r0, &(0x7f000002efe2)=[{0x0, 0x9}], 0x1) semop(r0, &(0x7f000001a000)=[{}, {}], 0x2) semop(r0, &(0x7f0000176ff5)=[{}, {}], 0x2) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000500)) 10:06:33 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000002c0)=@ioapic={0x1, 0xfdfdffff, 0x0, 0x0, 0x80ffff}) 10:06:33 executing program 3: r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) r3 = syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) write$sndseq(r3, &(0x7f00000001c0)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {}, {}, @connect}], 0x30) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000080)={0x0, 0xa7e, 0x26}) [ 122.304252] binder: 8551:8556 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 122.314403] binder: 8551:8556 got transaction to context manager from process owning it [ 122.322687] binder: 8551:8556 transaction failed 29201/-22, size 0-0 line 2843 [ 122.336196] binder: BINDER_SET_CONTEXT_MGR already set [ 122.343104] binder: 8551:8556 ioctl 40046207 0 returned -16 [ 122.376780] binder: undelivered TRANSACTION_ERROR: 29201 10:06:34 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFCONF(r1, 0x800448d2, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'bpq0\x00', @ifru_hwaddr=@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}) 10:06:34 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) read(r2, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000200)) r3 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 10:06:34 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(&(0x7f00000001c0)=[{r0}], 0x1, 0x0) 10:06:34 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r2 = dup2(r1, r1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x31, 0xffffffffffffffff, 0x0) ioctl$EVIOCGID(r2, 0x80044501, &(0x7f0000000340)=""/4096) 10:06:34 executing program 7: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000000)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7050000020000006a0a00fe000000008500000020000000b7000000000000009500040000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r0, 0x0, 0xe, 0xd7, &(0x7f00000000c0)="3c2dbcd405e8e96a639a2feea71b", &(0x7f0000000380)=""/215}, 0x28) 10:06:34 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000240)={0x0, {0x2}, {0x2, 0x0, @multicast1=0xe0000001}, {0x2}, 0x2a0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)}) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000300)={0x0, {0x2}, {0x2, 0x0, @multicast2=0xe0000002}, {0x2}, 0xab852ebbeefbd631, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)='syz_tun\x00'}) 10:06:34 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x805, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000001c0)) 10:06:34 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmsg$kcm(r0, &(0x7f0000000700)={&(0x7f0000000200)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000000580), 0x0, &(0x7f0000000640)=""/143, 0x8f}, 0x1) 10:06:34 executing program 2: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) clone(0x0, &(0x7f00000024c0), &(0x7f0000002540), &(0x7f0000002580), &(0x7f00000025c0)) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace(0x4207, r1) wait4(r1, &(0x7f0000000280), 0x0, &(0x7f00000002c0)) 10:06:34 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket(0xa, 0x5, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000009fe8)={0xaa, 0xe}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000280)={{&(0x7f000090c000/0x1000)=nil, 0x1000}, 0x1}) madvise(&(0x7f000090b000/0x3000)=nil, 0x3000, 0x4) dup3(r1, r2, 0x0) 10:06:34 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="45965a5c4f0f0000000030e12924ad83c980ba3cec5e2d2ad6ef20"], &(0x7f0000000000)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6", 0x0, 0xce, &(0x7f0000000300)=""/206}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000028000006a0a00fffffff6006118"], &(0x7f0000000080)='syzkalleP\x00', 0x0, 0xce, &(0x7f0000000180)=""/206}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x8, 0x5, &(0x7f0000000040)=@framed={{0x18}, [@jmp={0x5}], {0x95}}, &(0x7f0000000280)='GPL\x00', 0x9, 0x27d, &(0x7f0000000480)=""/187}, 0x48) 10:06:34 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0xc0010000}]}) 10:06:34 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFCONF(r1, 0x800448d2, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'bpq0\x00', @ifru_hwaddr=@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}) 10:06:34 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00009b4fd0)={0x4, 0x0, &(0x7f0000009ff0)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040), 0x4, 0x0, &(0x7f0000000080)="40c03b1a"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000008000)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000000f4d)}) 10:06:34 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x805, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000001c0)) 10:06:35 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFCONF(r1, 0x800448d2, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'bpq0\x00', @ifru_hwaddr=@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}) 10:06:35 executing program 5: r0 = userfaultfd(0x0) fallocate(r0, 0x0, 0xfffffffffffffffa, 0x0) 10:06:35 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x805, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000001c0)) 10:06:35 executing program 7: r0 = syz_open_dev$evdev(&(0x7f000004a000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000040)={0x0, 0x35d, &(0x7f000082f000)}) 10:06:35 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3a) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x5}, 0x1c) 10:06:35 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFCONF(r1, 0x800448d2, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'bpq0\x00', @ifru_hwaddr=@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}) 10:06:35 executing program 4: r0 = open(&(0x7f0000000040)='./file0\x00', 0x8040, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 10:06:35 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_mount_image$gfs2(&(0x7f0000000140)='gfs2\x00', &(0x7f0000000080)='./file0\x00', 0x3ff, 0x0, &(0x7f0000001800), 0x0, &(0x7f0000000180)={[{@lockproto_nolock='lockproto=lock_nolock', 0x2c}, {@locktable={'locktable', 0x3d, '/dev/uinput\x00'}, 0x2c}]}) 10:06:35 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) read(r2, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000200)) r3 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) [ 124.241498] binder: BINDER_SET_CONTEXT_MGR already set [ 124.254159] binder: 8616:8623 ioctl 40046207 0 returned -16 [ 124.260113] binder: 8616:8639 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 124.283464] binder: undelivered death notification, 0000000000000000 10:06:36 executing program 5: r0 = userfaultfd(0x0) fallocate(r0, 0x0, 0xfffffffffffffffa, 0x0) 10:06:36 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x805, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f00000001c0)) 10:06:36 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f00000002c0)=ANY=[@ANYBLOB="3bff53"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:36 executing program 7: syz_mount_image$jfs(&(0x7f0000001340)='jfs\x00', &(0x7f0000001380)='./file0\x00', 0x0, 0x0, &(0x7f0000001640), 0x0, &(0x7f00000016c0)={[{@discard='discard', 0x2c}]}) 10:06:36 executing program 4: socketpair$unix(0x1, 0x2000000000000001, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) shutdown(r0, 0xffffffffffffffff) 10:06:36 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3a) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x5}, 0x1c) [ 124.442187] gfs2: fsid=_dev_uinput: Trying to join cluster "lock_nolock", "_dev_uinput" [ 124.450494] gfs2: fsid=_dev_uinput: Now mounting FS... [ 124.457247] attempt to access beyond end of device [ 124.462222] loop3: rw=4096, want=136, limit=1 [ 124.466753] gfs2: error 10 reading superblock [ 124.471297] gfs2: fsid=_dev_uinput: can't read superblock [ 124.476873] gfs2: fsid=_dev_uinput: can't read superblock: -5 10:06:36 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) connect$inet(r0, &(0x7f00002daff0)={0x2, 0x4e23}, 0x10) sendto$inet(r1, &(0x7f00004eef09)="96", 0x1, 0x4001, &(0x7f0000848ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000266ffc), 0x4) recvmmsg(r0, &(0x7f0000004440)=[{{&(0x7f0000004040)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000004400)=[{&(0x7f0000004300)=""/221, 0xdd}], 0x1}}], 0x1, 0x0, &(0x7f00000045c0)={0x0, 0x1c9c380}) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000006600)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f00000065c0)={&(0x7f0000006100)={0x14, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x14}, 0x1}, 0x0) 10:06:36 executing program 5: r0 = userfaultfd(0x0) fallocate(r0, 0x0, 0xfffffffffffffffa, 0x0) 10:06:36 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000000)={0x1, {{0x2, 0x0, @multicast1=0xe0000001}}}, 0x1af) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000140)={0x2, {{0x2, 0x0, @multicast2=0xe0000002}}, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x108) setsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000100)={@multicast1=0xe0000001, @remote={0xac, 0x14, 0x14, 0xbb}, @dev={0xac, 0x14, 0x14}}, 0xc) [ 124.624183] gfs2: fsid=_dev_uinput: Trying to join cluster "lock_nolock", "_dev_uinput" [ 124.632452] gfs2: fsid=_dev_uinput: Now mounting FS... 10:06:36 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3a) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x5}, 0x1c) 10:06:36 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') fchdir(r0) syz_fuseblk_mount(&(0x7f00000003c0)='./file1\x00', &(0x7f0000000400)='./0-/e0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 124.697583] attempt to access beyond end of device [ 124.702675] loop3: rw=4096, want=136, limit=1 [ 124.707225] gfs2: error 10 reading superblock [ 124.711763] gfs2: fsid=_dev_uinput: can't read superblock [ 124.717350] gfs2: fsid=_dev_uinput: can't read superblock: -5 10:06:37 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0x80008, 0x0, 0xffffffffffffffff, 0x0, [0x18]}, 0x2c) 10:06:37 executing program 5: r0 = userfaultfd(0x0) fallocate(r0, 0x0, 0xfffffffffffffffa, 0x0) 10:06:37 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_mount_image$gfs2(&(0x7f0000000140)='gfs2\x00', &(0x7f0000000080)='./file0\x00', 0x3ff, 0x0, &(0x7f0000001800), 0x0, &(0x7f0000000180)={[{@lockproto_nolock='lockproto=lock_nolock', 0x2c}, {@locktable={'locktable', 0x3d, '/dev/uinput\x00'}, 0x2c}]}) 10:06:37 executing program 7: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x40085112, &(0x7f0000b18000)={{0xffffff94}}) close(r1) 10:06:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3a) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x5}, 0x1c) 10:06:37 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(tea)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003c1000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x38}, [{}]}, 0x78) 10:06:37 executing program 6: syz_mount_image$btrfs(&(0x7f0000000080)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000280)="8da4363a00000000000000000000004d01000000000000000000000000000000ecf6f2a2299748aeb81e1b00920efd9a000001000000000001000000000000005f42485266535f4d", 0x48, 0x10000}], 0x0, &(0x7f0000000240)) 10:06:37 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) read(r2, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000200)) r3 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 10:06:37 executing program 5: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) rt_sigaction(0x22, &(0x7f0000000040), &(0x7f0000000080), 0x8, &(0x7f00000000c0)) [ 125.633267] gfs2: fsid=_dev_uinput: Trying to join cluster "lock_nolock", "_dev_uinput" [ 125.641583] gfs2: fsid=_dev_uinput: Now mounting FS... [ 125.651732] BTRFS: device fsid ecf6f2a2-2997-48ae-b81e-1b00920efd9a devid 0 transid 0 /dev/loop6 [ 125.675479] attempt to access beyond end of device 10:06:37 executing program 7: r0 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r0, 0x1, &(0x7f0000258f88)) msgsnd(r0, &(0x7f0000000040)={0x1}, 0x0, 0x0) msgctl$IPC_SET(r0, 0x1, &(0x7f0000000380)={{}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) 10:06:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={&(0x7f00000000c0)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x20, 0x10, 0x829, 0x0, 0x0, {0x3}, [@nested={0xc, 0x2, [@typed={0x8, 0x0, @str='\x00'}]}]}, 0x20}, 0x1}, 0x0) 10:06:37 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0x80008, 0x0, 0xffffffffffffffff, 0x0, [0x18]}, 0x2c) [ 125.680645] loop3: rw=4096, want=136, limit=1 [ 125.685193] gfs2: error 10 reading superblock [ 125.689737] gfs2: fsid=_dev_uinput: can't read superblock [ 125.695370] gfs2: fsid=_dev_uinput: can't read superblock: -5 10:06:37 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="1bd45006000000d1240970") r1 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r1, 0x800000c0045009, &(0x7f0000000000)=0x10) read$eventfd(r1, &(0x7f0000000040), 0x8) 10:06:37 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_mount_image$gfs2(&(0x7f0000000140)='gfs2\x00', &(0x7f0000000080)='./file0\x00', 0x3ff, 0x0, &(0x7f0000001800), 0x0, &(0x7f0000000180)={[{@lockproto_nolock='lockproto=lock_nolock', 0x2c}, {@locktable={'locktable', 0x3d, '/dev/uinput\x00'}, 0x2c}]}) 10:06:37 executing program 5: r0 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f00000003c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a}, 0x0, 0x0, r1) r3 = add_key$user(&(0x7f00003bd000)='user\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a}, &(0x7f0000000440)='\x00', 0x1, r2) r4 = add_key$user(&(0x7f0000fc0ffb)='user\x00', &(0x7f0000752ffb)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00003eb000)="b3", 0x1, r2) keyctl$update(0x2, r4, &(0x7f0000000480)="df02754677212dfc3e2acc26fdc3ffa64813da494137e175e9f2780ac5e2a09f43a1fcebf272a5a135de92bf4a9033933824f6e6aa023895113293535d1c0066d20e0f275188b4b4c187e18774fc2227cbb60fc6697f5337726164c8fbe1181e6d50986cd98a5c44ac0ec375deb27eafcf7d06438f252510d87bd91d03e7dc2faed85adcd88ca30e75b1e143a72d94defa187e48b89efbbbcc9b9a9a307353df7a21affce4e9149eb122cbc356cb681365afd979e97b57b596e901864a68679f", 0xc0) keyctl$dh_compute(0x17, &(0x7f0000000100)={r3, r4, r3}, &(0x7f0000a53ffb)=""/5, 0x5, &(0x7f0000c61fc8)={&(0x7f0000a3dffa)={'sha224-avx\x00'}, 0x0, 0x9}) 10:06:37 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$setptracer(0x59616d61, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000380)=0x2) prctl$setptracer(0x59616d61, 0x0) socket(0x0, 0x0, 0x0) 10:06:37 executing program 2: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = epoll_create(0x277) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000000)=0xec35) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)) 10:06:37 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0x80008, 0x0, 0xffffffffffffffff, 0x0, [0x18]}, 0x2c) [ 126.016789] gfs2: fsid=_dev_uinput: Trying to join cluster "lock_nolock", "_dev_uinput" [ 126.025035] gfs2: fsid=_dev_uinput: Now mounting FS... [ 126.030961] attempt to access beyond end of device [ 126.035970] loop3: rw=4096, want=136, limit=1 [ 126.040513] gfs2: error 10 reading superblock [ 126.045066] gfs2: fsid=_dev_uinput: can't read superblock [ 126.050674] gfs2: fsid=_dev_uinput: can't read superblock: -5 10:06:37 executing program 6: mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'sit0\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', 0x402}) r1 = syz_open_dev$tun(&(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000100)) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x20000000000002ac, &(0x7f0000000140)}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) 10:06:37 executing program 2: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgrp(0x0) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0xfff}, r2, 0x0, 0xffffffffffffffff, 0x0) rt_sigtimedwait(&(0x7f0000448000), &(0x7f0000d31ff0), &(0x7f00007adff0)={0x77359400}, 0x8) write(r1, &(0x7f00000001c0), 0xfffffef3) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) 10:06:37 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_mount_image$gfs2(&(0x7f0000000140)='gfs2\x00', &(0x7f0000000080)='./file0\x00', 0x3ff, 0x0, &(0x7f0000001800), 0x0, &(0x7f0000000180)={[{@lockproto_nolock='lockproto=lock_nolock', 0x2c}, {@locktable={'locktable', 0x3d, '/dev/uinput\x00'}, 0x2c}]}) 10:06:37 executing program 5: getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000180)={0x0, @in={{0x2, 0x0, @loopback=0x7f000001}}}, &(0x7f0000000240)=0x84) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x800, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000001fb2)=""/1, 0x1}], 0x20000000000002e9) 10:06:37 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$setptracer(0x59616d61, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000380)=0x2) prctl$setptracer(0x59616d61, 0x0) socket(0x0, 0x0, 0x0) [ 126.386712] gfs2: fsid=_dev_uinput: Trying to join cluster "lock_nolock", "_dev_uinput" [ 126.394969] gfs2: fsid=_dev_uinput: Now mounting FS... [ 126.408201] attempt to access beyond end of device [ 126.413347] loop3: rw=4096, want=136, limit=1 [ 126.417978] gfs2: error 10 reading superblock [ 126.422617] gfs2: fsid=_dev_uinput: can't read superblock [ 126.428182] gfs2: fsid=_dev_uinput: can't read superblock: -5 10:06:38 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) read(r2, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000200)) r3 = gettid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 10:06:38 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000013000)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000004ff0)={0x3, &(0x7f0000002fe8)=[{0x1d, 0x80000001, 0x4000000000401}, {0x60}, {0x6}]}, 0x10) 10:06:38 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000003000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000100)="0fc5f40bf00fb020dfdbb9840b00000f32c4c2a598d6c4e272f51d00780000c4c2f91cc2c4c2550c84eb00000000c4c16812f566ba4200b81f7c1097ef", 0x3d}], 0x1, 0x32, &(0x7f0000000180), 0x0) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000180)=ANY=[@ANYBLOB="020000000000000001000000000000000000000000000000000000000000000008000080f87f"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:38 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0x80008, 0x0, 0xffffffffffffffff, 0x0, [0x18]}, 0x2c) 10:06:38 executing program 6: syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/packet\x00') accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) r0 = socket$alg(0x26, 0x5, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000540)='fou\x00') ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, &(0x7f0000000100)) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif-pclmul\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000040), 0x0) sendmsg$rds(r1, &(0x7f0000000880)={&(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000440)=""/149, 0xfffffdef}], 0x1, &(0x7f00000006c0)}, 0x0) 10:06:38 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000360000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f000033c000)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x1, 0x0, 0x0, 0x0, {0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@mcast1={0xff, 0x1, [], 0x1}, @in6=@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}}}]}, 0x80}, 0x1}, 0x0) 10:06:38 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$setptracer(0x59616d61, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000380)=0x2) prctl$setptracer(0x59616d61, 0x0) socket(0x0, 0x0, 0x0) 10:06:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000400)={0x14, r1, 0x301, 0x0, 0x0, {0xb}}, 0x14}, 0x1}, 0x0) 10:06:39 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000c34000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000b4e000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r1 = gettid() process_vm_writev(r1, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1}], 0x1, &(0x7f0000c22fa0)=[{&(0x7f00007a9000)=""/1, 0x1}], 0x1, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0) close(r0) 10:06:39 executing program 7: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4, 0x4, 0x4, 0x9}, 0x2c) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000080), &(0x7f00000000c0)="14"}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={r0, &(0x7f0000000080)}, 0x10) 10:06:39 executing program 2: r0 = socket$kcm(0x29, 0x10000000000002, 0x0) r1 = memfd_create(&(0x7f0000000240)="74086e750000000000000000008c00", 0x0) pwritev(r1, &(0x7f0000f50f90)=[{&(0x7f00001f2000)="aa", 0x1}], 0x1, 0x800000) sendfile(r0, r1, &(0x7f0000000000), 0x101f7fffd) 10:06:39 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$setptracer(0x59616d61, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000380)=0x2) prctl$setptracer(0x59616d61, 0x0) socket(0x0, 0x0, 0x0) 10:06:39 executing program 5: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x89f1, &(0x7f0000000040)={'ip_vti0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) 10:06:39 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x7f3, 0x40) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000010000000c64459685856bb12c3554ce8899f94073207e6061f62cacfb1d8ea0153cee9342f107a063d18acd0029139d23dbb4cdab1d86aef5ad7b340b939ef9c6fa8b1579f9be57d65b23676cf61c17c07afe5dd7a7cf3721a5bb2441b58df66b2"], 0x14}, 0x1}, 0x0) 10:06:39 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x200000000008912, &(0x7f00000001c0)="0047fc2f01d82c19240970") r1 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000480), &(0x7f00000004c0)=0x14) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1_mb\x00'}, 0x58) r2 = accept4(r1, 0x0, &(0x7f0000000440), 0x0) sendmsg$kcm(r2, &(0x7f0000000400)={&(0x7f0000000140)=@ax25={0x3, {"055c99c0caa6b6"}}, 0x80, &(0x7f0000000200), 0x0, &(0x7f0000000480)}, 0x8000) accept4$vsock_stream(r2, &(0x7f0000000680)={0x28, 0x0, 0x0, @host=0x2}, 0x10, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000500)='/dev/audio#\x00', 0x0, 0x400401) ioctl$KVM_PPC_GET_PVINFO(r3, 0x4080aea1, &(0x7f0000000540)=""/250) writev(r0, &(0x7f00000003c0)=[{&(0x7f00000006c0)="c5acd3560f64330d9772516a81da84431f9efa7c208a6634eaa243d7438dfa530a3e203d00655b9f1598e413f7f3fa886bf5421118c31d363f50a45cc63a5004b58c9fd76952c723457c8e6e65b00f049d2f12f6d70b107b4ea86fd9e9297c3f47b257e417d9faf028fc2fd5846e53deda1323ecb5d842d0116e57fa6205ee2789323644d6f2fccb5aef570da04f771f74e98b568ee4aca48cd7af10c4feed33d400000000000000000000", 0xab}, {&(0x7f0000000800)="8e2f5ec1acaeda159aa15e5a31c3f189e9b48d7f56a7b4bbfa529a9a38422487c718818e8d3bec855689979c0874935b014b0d437191df171a25a73956684355ebfc5da9b89ba833ead518ea91863ede0c7b2b570644aadea65654e635557cf08438bdca17855ba4f0f39e137a67a095fbc8f334d46dfab8537c7fe0f893734878bf27c8a30c3934bc1ae2ff87af0b9cda48561335bf597bff73f0c7cc286640a40dd5df539f70f5ea4617fad2d0f33912e9", 0xb2}, {&(0x7f0000000780)="b15b6bd969074e50b38138ddc655202dbbcbbc65b0c1c22ed40cc84e91142bb55c0532fa2bf670128a68d872b2f1208eae462bd8c7e31b0578d9fadb85b47530354e5043c5072844d0b838979d14c6c2afaa8b82a4e2acf2120502723e961e0cc27ad81a605e4ef8cb22", 0x374}, {&(0x7f0000000340)="0058e298a940fe76d6a19019a5a23d9c6416575ec0e8801d7502fcd66b5ededfd97e7817002b840f10a82c1bb77414303f3d45c48e0be57726dfa267e903e2d0bef26335509aac207e3a823edd5f7b66481f2ccb438e9fb84843663f0a", 0x11}], 0xfaf) 10:06:40 executing program 2: r0 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffb) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$unlink(0x6, r0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x54301) setsockopt$ipx_IPX_TYPE(r1, 0x100, 0x1, &(0x7f0000000040)=0x80, 0x4) 10:06:40 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:40 executing program 6: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x20000, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x4003, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000541000/0x1000)=nil, 0x1000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0x405c5503, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) 10:06:40 executing program 5: mkdir(&(0x7f00000001c0)='./file0\x00', 0x1) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x1, &(0x7f0000000040)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000000980)='./file0\x00', &(0x7f00000003c0)='\x00\x00\x00\x00\x00', 0x100000, &(0x7f00000009c0)) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x100) r1 = msgget(0x0, 0x440) msgrcv(r1, &(0x7f00000000c0)={0x0, ""/100}, 0x6c, 0x2, 0x2000) clone(0x1b11b20000, &(0x7f0000000000), &(0x7f0000000500), &(0x7f00000002c0), &(0x7f0000000440)) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000040)=0x3, 0x4) 10:06:40 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c200000000000000000086dd6009000000303a0000000000000000000000000000000000ff000000000000000000000000f50001830090780000000060a97187ffffe90000000000000000000000000000000001000000000000000000000000000000010714cab76a38af52cddcdc53202545b046243ce62443e213"], 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_all\x00', 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000000c0)=0x14) bind$can_raw(r0, &(0x7f0000000100)={0x1d, r1}, 0x10) 10:06:41 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) restart_syscall() r1 = bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xe, 0x4, 0x4, 0x8000000000009, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa]}, 0x2c) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000140)={0x4, 0x400, 0x3, 0xc129, 0x4, [{0x6, 0x7, 0x7ff, 0x0, 0x0, 0x8}, {0xc5c1, 0x6, 0x1000}, {0x8001, 0x3, 0x3, 0x0, 0x0, 0x9}, {0x3, 0xffffffffffffffff, 0x7, 0x0, 0x0, 0x1000}]}) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000100)={0x5, 0x0, 0x7, 0xe3e1}) ioctl$sock_ipx_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'syzkaller0\x00', {0x4, 0x5, 0x7, "7d3d18faa658", 0x2}}) 10:06:41 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:41 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha1\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) recvmsg(r1, &(0x7f0000000780)={&(0x7f0000000200)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000680)=[{&(0x7f00000000c0)=""/56, 0x38}], 0x1, &(0x7f0000000700)=""/71, 0x47}, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x81, 0x1) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000080), 0x1, 0x0) 10:06:41 executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000580)='/dev/dsp\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") read(r0, &(0x7f0000000140)=""/181, 0xb5) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4002, 0x8000000002000005, 0xa2011, r0, 0x0) 10:06:41 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) restart_syscall() r1 = bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xe, 0x4, 0x4, 0x8000000000009, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa]}, 0x2c) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000140)={0x4, 0x400, 0x3, 0xc129, 0x4, [{0x6, 0x7, 0x7ff, 0x0, 0x0, 0x8}, {0xc5c1, 0x6, 0x1000}, {0x8001, 0x3, 0x3, 0x0, 0x0, 0x9}, {0x3, 0xffffffffffffffff, 0x7, 0x0, 0x0, 0x1000}]}) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000100)={0x5, 0x0, 0x7, 0xe3e1}) ioctl$sock_ipx_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'syzkaller0\x00', {0x4, 0x5, 0x7, "7d3d18faa658", 0x2}}) 10:06:41 executing program 2: r0 = memfd_create(&(0x7f0000029000)='\\\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000032ff3)='/dev/snd/seq\x00', 0x0, 0x6) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000051f50)={{0x80}, 'port1\x00'}) write$sndseq(r0, &(0x7f0000042f70)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, @tick, {}, {}, @addr}], 0x90) 10:06:41 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) restart_syscall() r1 = bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xe, 0x4, 0x4, 0x8000000000009, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa]}, 0x2c) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000140)={0x4, 0x400, 0x3, 0xc129, 0x4, [{0x6, 0x7, 0x7ff, 0x0, 0x0, 0x8}, {0xc5c1, 0x6, 0x1000}, {0x8001, 0x3, 0x3, 0x0, 0x0, 0x9}, {0x3, 0xffffffffffffffff, 0x7, 0x0, 0x0, 0x1000}]}) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000100)={0x5, 0x0, 0x7, 0xe3e1}) ioctl$sock_ipx_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'syzkaller0\x00', {0x4, 0x5, 0x7, "7d3d18faa658", 0x2}}) 10:06:41 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup\x00', 0x200002, 0x0) r1 = dup(r0) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f0000000000)) r2 = openat$cgroup_type(r0, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) preadv(r2, &(0x7f00000002c0), 0x0, 0x0) 10:06:41 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x2, &(0x7f0000000140), 0x1) io_setup(0x4, &(0x7f0000000080)=0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) io_getevents(r1, 0x0, 0x8, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000200)={r2, r3+10000000}) r4 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7fff, 0x20000) mq_timedreceive(r4, &(0x7f0000000240)=""/197, 0xc5, 0xcd17, &(0x7f0000000340)) ioctl$KVM_ARM_SET_DEVICE_ADDR(r4, 0x4010aeab, &(0x7f0000000040)={0x9, 0xd000}) 10:06:41 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0xb, 0x7f, 0x7, 0x5, 0x1}, 0x2c) writev(r0, &(0x7f0000001340)=[{&(0x7f0000000000)="25f43d2a789837be74a684a04e16c4187c711c4c94f9412395d40cbad9e5921a75b8e2", 0x23}, {&(0x7f00000013c0)="0d671566d0c9d2f37bf62ef72edbcb440b61c0d03a0774eeb8d4320ebad25a3d306d01e7ea2bfafec204d2dc9d7c51dc80929562f676b70a8a0769ec7617c5ff0779b1cd917f1aea070e4f9fc8c70b59f1edd24c97b18bddb556e5cf72bf7eeb8407d23d85", 0x65}, {&(0x7f00000001c0)="036b872c883da3505d0a1e84de03a02db6e054061d69082803e91d27d3039996fb4d9d7c9ac5b6e6fb678720519494ec0300ae058e63a2910952ed8867b8330a17b1b201b88a654e55896c14eefbb5cdee1466b9d560528036284a2f16dc4c3d92a756ebc11c1a6e7e58e1cda47968983315819f7bf3a86ec650c58154f064b6047b3311c807a0303d7e9ba9fc0ac49062c9a92218d454b5f6d5f7b7fa3665255f7c232f7f8c1041794d8e848b68cc9f3d525ad60875a7f3cc6f9070d07967222b62cd05714c0097e84915e428c68d92e301a4d491ce01b2a1772cb2149d78b4956a", 0xe2}, {&(0x7f00000002c0)="b10ba3e2088da732fa11f8bf2593a8b394ce045ed9bec0dccc7d14d880f7aaec11f05987a8977ff5a08ecb253ea35d5090ef889da4156099cf3d08e58a412774c9fd32ba25c43177e924d51b49a5fc72a592a4403238b856dda79cdc48307ba4452c5693259417b260811892590f7cd4c20961c0613c8c285d077bd6c878325cd1369613371d5740f2cd83fa6b1957d58bad45b10265968cb82ecb0dda603bddf3bb49792271f12794314c4baca083fdb4e7881dd402db8233149bd3c52173120487801427b239e2e3aa1ac65072765b2ee9918f286c6c5278f36794d099084656316b4080b6266b0fc5ce38caba86f2f9af77782f1f07898aac67dba8a81a2046ae1b96abe39bc2862057529a27847b2694c509f070a20d03c3e3ec3a1cc29fe2709949693b7e9117d3f20290552ab9a7e44a97b7159967e0cc88c9e8427639ed0d40651d36abc39045f4136f92ab14ebe0c331c29f76ff09683fbf2257f59c3b6d9efd311f0a04ed8f327a929f164b1705ab41172c66543860641cfde13b05126659bfcb80c06a2cfd3531b61d7f50c5d95f99fc55452b438c637e470995f29a419341188985e7214d1bce0d8966ca41964c53cb0ff959dfc83c63fc5ea23c881935dda64016c97de8e28ae72cda48725608b63d72e24fbe2fe8ad6ea75e387748570fe70a3a11cbe08b9ba952388339ff9f329046377a5b737cd3b4fdcc4efa9adfb4f7cbc904944f3dcaa451ca33f59a63116ba39b96f8ec45b6cebd57040736d53e567ef52e76d063213e94f2ca158a6365b8faac4e0a7ff61e655d5a9b05a77b33e0cdf9c12d6d5e6ccb8c170708efbfe1dc4ae8bf6008fa897d75005d208fc3cbbe69d1711001286453ca0b896a3fcb78bbf1fcd6820167b2723c8b283b718c53d8972107e20486a2bf5b31ccf49a03fdd42c1a8fa734e3c072de92484df794845e2ecd2e4f19a7ac24447c3b853e82c579d1e0638ebe2a64ff892eabf6972971e7e2c25adbf85a957379336545e9da971a336974d1f9beaa021988ab7f096a40d395b3d51c422954c6c57ce9e5bdfa5a757e97f33f96ed66fbe4302b3f8379c1a3826eccaba8bf287437fa803582b8b4b7d24dfc18302202eb1863ceba76af8ac4a4857e4013b29629451886ed99c5feabc3d06d21dd6434ba46da49fc81cae41cde65bb13d9b7c0d8eb50544a7d20ab53e757846e95490614e5ad5eb523856bc5770c6fdfb75a94b102f126f1e598b33c6177d434f3ed6281156aeef9048835b33a8214aa7504f8089cf5330c8608446972fe02d36bcd6ee435951fd935ff213380efaad59c4853531ef37e2910295723d52ed6978fd8c90419e0b7a8233cb3e583d6cef3c138bc0316d445b1a2d8409e4e37fabb3f145876af7f46cb9ea9a617db9e9572072a75c8826a4e85dea3669518c1f66180c1715d5cb8162b79fe12e4fa65b8405b65faef61af71c18bd644d19ddc4d94e70cbc87177482996b605ff4cd9bcbe4faba092fc561d625c22cecfda6f444ae28c1213d877d90ce45a9ac09e5d49b4eac790e86f2ca13499bb35b2a5458c12f8fac6bbea53a4aee2a3217761cecebd3ab5fee58df18a3f81835f00e600d055b256e29510806f95dc724ef31328feea497142cf673e080795d6a412f5f888d93a19369556237fbda88b9e91262342c7032d798fbfc3d9d0e9917dc6b1c3f4fb3d025c5c8537b140decdce7c1f5463fd8bff32c9410a24bf6749cf8a5e15a59cf5a73aaf98f3e10b73ef5b1d7c0561aff42e2d3b4a87b73e0cf9c7dd2326b46ca55c79d535bcab7451a6302956247100f092de5b5d9973d55ad3e77e4c45ef4766abf65841e0da509ebfdbe2793f8b746ef7c8035bb7cb96c74027b925e426dc4a2a5bd23b770e0df8f030081b07c1187d77d87e7ba71634dc89f1e2aa0d814323c1374f3b71e0997c25d57dd9820046aeeb821a3b82570cca6dee9e9c418041cf6ae4a06bcaed319a8a3fa9594de4e180ebc986e6a8ef39222c6d0b301a0b1cb09cbcf72d0bddc024341861f951b9c664b616c55a5b78279fa340dd169e7a2c1b939ec7ea85af2c19304dc54788c1e070e64d6c8b9796cfaa6a0194938c97b32c6217441ffff9c4f7fa9503227f604ced4537b46efc24b96bf825e24d6c22a85ccb1c70949c755a9e0f0d0fdc2dc41e212a81abb47d9f4c86f7187d7c339de9fe8d331fe95903f61926023fabb9251b5af27c27b5863bf47e22b9b0c5f8eb4f75a48f32fb4014858151b1a5630f3b474ee176e3f8d06f6bf82f6981842a7dd914849dae49fd19cdc4bdb83199059196f983703d6a229e0946e062ff4b9e6b5eb76aa4038173bbfdc2d06d3b7858ffdffd600dd106792d3964594a1a089d88d77da2ff920ecfa5d383ccfcfb5879dee5e451752c23ce40678b59f6cda78574a2c13b6201190f0a5adab11ab29bd55bb4e21a792cb974b530bf684123c627de7447637b6dfceb2d6341e96d14bd8276e1347f217e8218078f9bac0d9b0bbb589a5613da8de7eea9cd450a995c15802325c5c65acc346e7d6eec0bd5cec3d118f1108d8716d365be7e0a556327c1e02119d93146742a1e187b3fd8a0505551462ac29592052ba681bfd3d94035c63798df6d92efc9baa28e217f493ed4cc277bd0a3c8c6bc90a454c1022848bfb6053b6e6be2dfeb47bdc27491bc3c0487785cf842ffdbb21e44732cb922d2ec2ed712ca568f6e0fbb4d1a833dfa89831f9f253a0a594249581487263994516521d9b5f65f46116b491504726d75afa6f8e9bd02a71ba0a09e0457cc8d60d7c05fb7cc138e5345ad93600bc4c8b94fb6f42c271b1fd6cae4e796a64fbaff01aa71bb096f6000ea6206ec145f9faee49d3eb89f277df1765e8a6fd82bc3b40e06ecb581cd407cd934e95006397085d7afea9fbc4ec9648e3541d39a869f29c11d4785c199d75dfa02be7a3558e81be9f6b469935d7be085567413d31065d4ebc2dfb59e236ffa59f0f1506feda809cb8d91e8dfe5aa7a1374663ffd1c307c491af290459d0b35647b2a3fe0ebb81aa5c4f343ef39fb9f02c9444bb3eb9aa3fbe7bdac83b7eabf2781385a38f15f72e398d51a16887ee5c2694fdfc29bd4ef9ffc925ae6742b813d3b29b7707f459325e59f9fa2da7aecf46b5852d2d93015b738ac8a80b68617490ac33c0daeacf050136ecb16838e2256c7215f5dcea525f4b81ff40c248b2da7c16e14d00aa8f5091a380a9287026fa2e921acbfa81c8c9a4d071dae8388f31d9a2ccac76385ba71b58c615842f8b27df233e3bae0fa9b38638536449e69328137ba071449fee05d9745160a090d52bbe6edebed87424520a7892b5ac7dc9d6f077e7b936ebc737fe78e385ff4474a7841efab2db4e84155d11dc51e95abf54647d2d39ed918064b1cec1b91562a824c47e0e8adfb311b4267a5245db87b32133cd75cc6f3b43b045138f3d7464d8cb44337ca0a0cda9fa8a9d06de9742b5eaf8d0bddf141d513c46c241e3b8a3ce23ddddf8e7882a79e52dbeadb0e1ebd5ac83c192ac764856c2a3eb10982c3a661c9674f4658c6d17fdc8eea71857d02fc3202143bd29bc92eb91457453e067dcd670fe5e53b09af0a6a2ae3fdf0e1cd23caebfe362f2d2dcc339336c420459f2993bb9e848754c45d8ad17d5874d6a63e6011524fb873aa3a423c9fac516465242768de5056cf49008acf525e857a09e7b4b2d3023b8d2636d26f602852d8b942ebe97756975722ca7a6c9d0ff59071208f6191f5e49e3acff14060da13d80a3a3a982b7d5a3e02e92382a2bdb578b41494fac2164186072b1206d14871d9a8f0989740ba6d2cd8a00dd416d7273730a78db593a7b7b216962d4a92a04393fe4ec315bd08ea21ce2e3ec70c69ab36bfa16d680db06a209d4d53462fda04f9bdc0140c87dd0662188143d7eb34b17d82cdf301b18847b839b518b199010a0452c55571d1e6d7b78b692b5b6f3db95987baf890c7566480acc4fff9ca96c87bceb18f234ed10f5f32d4f4e02db78aa66ce82466e7ac3334551470e99c93dc0308fd058160b01e5da99ef262209bd0dc821cf5858dae6affc4521ac2c9e4d587d9acd0d66f92aa5809c073e97d0eabdbcbd6dd18b43eba1d11947006cde552ee52ff12c3555cd6df2973237676b5688d1a8b71e49f3fc7592e608068a8acb6b2cb700b82d6bf9d83db27c2ab323c104e6718081702e41929a048878c1c66cb6e81b8e96d50b15caff36c774b1fb145ff994486a5e95be20238094b1ae29dbfc5c8fbe94e50bbbbab4befb5087a8d92803bd0fceb694ed0ca9d1cd27cdbc28b0efa47112acbcb851257d26ee91f828535530242615fd328bccb5fc54f699ab7e64bc588d81f4fd90c2effa0dac4c8b585d696fda85e164594cb6d13a5e9a08b3118364f73bd406304a421936b6b1200eeff4b0f19cd335bd78c52a359a76ea24e99f92cdb7ab8b809fa2e8d0eb0cac6a2ab9498df1c8ebfc8144d53baad9d544b056f927b9d4b938e7a9c65fd5f32cbf92cb30075031dc071197bbfc322d819ddb131f44044f60f0059a92fe2b72e26c0aa7032de85123cc3baad9732d39504d99153017f6daa4b4be41aa5148c02074c8f012a7b53355f976fe4ace81533894029c3dcb2134399f4fb5b9bedd8980673ea6df6bb549241b2c66df69650ec573b70c4684da5d67ba96aaaf0e953f2f9cba677fcb4c2837dabb8752d01896316737426180f7a4a04e6eafa16c1a904d17787a92d9698797076497245d0b4d9b26345eaa3758564785e160f350eea9b2e0e0f0b48010bf4f8acc9cce33c6c752663b444cce0f094eae730b7ae128760b829f99289e431df4954deea2847a5894695643ac7d7a01bdde2ad192d81623843c12339c68a17c07fe892eb8602813b35d4e622346125217b7a000bede06ef3a4abfaa6c771feafe5d362747bf9c78cb5f06d8b5692613f6a46943e8704317f70d0b06e6bc5be27b75cd064116309dee05a3b91c48fd82a14891a936b239d8db0a3cbabb87bf1ea9cb8558bc4349a8f5ad1e3e5e0dd6af2161cea991928c2613ace5388db6b21bef01bf1f2270d502f518b748fe54d662f2361082fc04cb2df52afc80acc015b5c5c3cf02615096f68da9a7370e77e524424cc660e8ab06e4769ee3442d60cc4562f056ae88c00c165aa1845103613cc8117408f28a5f2cee1aa7965f6b61cb41951b63705f717bd4f46f3ef827aa9341adb68448fc4fd005b0f1d2c51d315edf5a0a95fc0cf0721ed695bf762ad83ca8ac5241a3646f124921a351fe53c01a4810907ccb365854f01424ea51782323aa6b9eff1ef833cc49e3f6185066a632111078e83e7e934a195ba763042da090141a631f9465170a5d5c81d0d4c06d79d989b2df4ca569dfbb75b61e5cffc0d61f0faf661756e7b62b140054216b475ff97c5d0ca71cbecbdc74acc21550849056d0ad4269706b30f576be08caf0b3882c5b68355b517d5704c1f8c7394bcef44f54147988c03ed9175dcb4f86a3c4c1093f6eb2a5c94ebacb582eab2ac807be3300f99a05bd1dff3cb21409031c4f8973a3ccfc5ac3a3f65d5652e9f8e062056b9003cb05dd7a01c8eb6de9d1d190312a49124ea9a5079d6c2ce4507cfd7587a5643b6a884cfa9a25ffb68673f63a978c3279ef0fd72a3664af5ce79dcd62c969f6849bf7ad5ece6073b4be12f0bc40173fb98da2a2728b60b33939c5cee1a8eff03b497a1795b6cf556dda006ccf1c9813a491d7f48e2abebbabe3f41bd3bf91912a", 0x4}, {&(0x7f00000000c0)="2bab581a0534618ad31eaad57c45d6add7f360828a1bd80a8b925b569de5a1f51860d5c2ea7fb3a9d1ab660ccc9db48480a1081ffb1a772412ed362a74ec116c0e8a55330efeb383c10bed9e1bd96c35cc09e7cfc47c0aae947974e26b0d1844385574cd783d6639e17b23ad34c018bd75931ff5546a5c0758f3b17baab34ff95e8ed0ec8852d296b8f517ca2f5f052d5574718f7293a5f749b6b47376", 0x9d}, {&(0x7f00000012c0)="3754abeb130b10297dddc9bbea96baeaf3495911f4c6830889d43203a9013a6b7a6f0318510b46bc52ff98a45e8559f4fa682833c3cfb2ace5bc83feeecdc4018af273773b5285ff56f72cc002fa8537566a8ab48d6514e405d8a977c9eb5447f54606d74c610caa37b4361bd0210df6e9f6", 0x72}], 0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000ed1000)={0xf, 0x4, 0x81000000004, 0x8000000007}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f0000002ac0)={0xf, 0x7, &(0x7f0000001440)=@framed={{0x18}, [@map={0x18, 0x0, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001480)='syzkaller\x00', 0x3, 0x1000, &(0x7f00000014c0)=""/4096}, 0x48) 10:06:41 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl(r1, 0x8910, &(0x7f0000000100)="0047fc2f07d82c99240970") connect$inet6(r0, &(0x7f0000000080)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x13a) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_buf(r0, 0x11a, 0x1, &(0x7f0000000680)=""/4096, &(0x7f0000000180)=0x3) 10:06:41 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000040)='mime_typ)em0eth0\x00') r1 = accept(0xffffffffffffffff, &(0x7f0000000100)=@rc, &(0x7f0000000200)=0xfffffffffffffe64) r2 = accept$ax25(0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000280)=0x10) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) clock_nanosleep(0x1, 0x1, &(0x7f0000000340)={r3, r4+10000000}, &(0x7f0000000380)) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f00000002c0)={r2}) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r5, 0x894b, &(0x7f00000000c0)) timerfd_create(0x6, 0x80000) 10:06:41 executing program 2: r0 = socket(0x11, 0x3, 0x0) bind$netrom(r0, &(0x7f0000000080)=@full={{0x3, {"532eee1dd9861f"}}, [{"6116781c4cbb46"}, {"b7781f75039bdd"}, {"72b53628e67a38"}, {"6494997703c20a"}, {"1bffc770e63b56"}, {"ebee4827ec3c02"}, {"cb2e174665254e"}, {"81be414cb7201b"}]}, 0x48) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x400, 0x10000) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000040)) 10:06:41 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x200000, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x3, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000, 0x1, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0x0, r0, 0x0) r1 = inotify_init() r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r2, 0x40046411, &(0x7f0000000000)=0x5) r3 = dup3(r1, r2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000003840)={{{@in=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000003940)=0xe8) sendmsg$nl_route(r3, &(0x7f0000003a00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000039c0)={&(0x7f0000003980)=@getstats={0x1c, 0x5e, 0x208, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, 0x3}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040040}, 0x4040) unlink(&(0x7f00000000c0)='./file0\x00') 10:06:41 executing program 6: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="0a5600000000000000000000028000007a0a00ffff0900fd63010c"], &(0x7f0000000000)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6", 0x0, 0xce, &(0x7f0000000300)=""/206}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x9, 0x5, &(0x7f0000000040)=@framed={{0x18}, [@jmp={0x5}], {0x95}}, &(0x7f00000004c0)="73797a6b584e3e2f9afed6d0ee3d5d5de2f791e4545b69c564e359a02949ab535c1b25caa665b968d2f1a32e3febe4189befa5f044722bae83e5b6959e392e8d24e41b4ce153c97b5a23e135e38d3b1d14ad7a9eeb7069347fee053569544f1a0000000000000000", 0x9, 0xbb, &(0x7f0000000540)=""/187}, 0x48) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x1, 0x0) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000000180)=""/88, &(0x7f00000000c0)=0x58) 10:06:41 executing program 2: setgroups(0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00007e5000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x200000, 0x0) getsockopt$inet6_buf(r1, 0x29, 0xdc, &(0x7f0000000100), &(0x7f0000000140)) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f0000000000)=""/92, &(0x7f0000000080)=0x5c) 10:06:41 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000100)={'nat\x00'}, &(0x7f0000000180)=0x78) getgroups(0x0, &(0x7f00000001c0)) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x2000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40, 0x20) sendto$unix(r1, &(0x7f0000000040), 0x0, 0x8000, &(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e) r2 = socket$inet6(0xa, 0x6, 0x200000000000) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000280)={'bridge_slave_0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="410000000002000000000000000000000d000000000000000000000000269fd8d0649b076600000000000000"]}) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f00000001c0)={0x0}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f00000002c0)={0x0, 0x4}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000340)={r3, 0x0, 0x80000000, 0xffff, 0x9, 0x85fe, 0x8001, 0x40, {r4, @in={{0x2, 0x4e22, @loopback=0x7f000001}}, 0xfffffffffffffffe, 0x8, 0xc8, 0x3, 0x9}}, &(0x7f0000000400)=0xb0) 10:06:42 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000), 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) 10:06:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000180)="0fc72b0f070f01d1652e0fc71a0f38cbda660f38003c0f97860d000f070f0f4a091c66b9800000c00f326635010000000f30", 0x32}], 0x1ff, 0x0, &(0x7f0000000080), 0x0) 10:06:42 executing program 1: r0 = getpid() mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) sched_setaffinity(r0, 0x8, &(0x7f00000001c0)=0x6) unlink(&(0x7f0000f86000)='./control/file0\x00') rmdir(&(0x7f00000000c0)='./control\x00') syz_fuse_mount(&(0x7f0000000240)='./control\x00', 0x406000, 0x0, 0x0, 0x0, 0x0) syz_fuseblk_mount(&(0x7f0000000200)='./control\x00', &(0x7f0000000280)='./control/file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) close(r1) 10:06:42 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-simd\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = open(&(0x7f00004b8ff8)='./file0\x00', 0x28042, 0x0) fallocate(r2, 0x0, 0x0, 0x73e0) sendfile(r1, r2, &(0x7f00007ed000), 0xffa) 10:06:42 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket(0x11, 0x100000802, 0x0) r2 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x4012}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x339) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={'ifb0\x00', 0xa201}) close(r2) 10:06:42 executing program 2: perf_event_open(&(0x7f0000000200)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) 10:06:42 executing program 3: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000180)=ANY=[], 0xfffffd97) mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0) 10:06:42 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fdd000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f0000000240)="8b480066b8004000000f23c80f21f86635000010000f23f80f01ca360f01f30f46ba4fd566b8050000000f23d00f21f86635300000040f23f80f01cf66b9410101c00f32656565650f01cb0f0d5f3c", 0x4f}], 0x1, 0x0, &(0x7f0000000300), 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000003c0)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x8005001f}) ioctl$KVM_SET_GUEST_DEBUG(r2, 0xc018ae85, &(0x7f0000000100)) 10:06:42 executing program 0: r0 = memfd_create(&(0x7f0000033ff3)='\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x20005) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000037000)={0x0, 0x0, 0x0, "9ede7a8c5ae95e48008000000000007f4f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa0500000074dbcfa6dc4d"}) write$sndseq(r0, &(0x7f000000a000)=[{0x7, 0x21, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000038ffe)}}], 0x30) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x3f, @tick=0xfffffdfd}) 10:06:42 executing program 4: r0 = socket(0xa, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f0000000040)=0xffff, 0x4) bind$unix(r2, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) listen(r2, 0x0) connect$unix(r1, &(0x7f000066fff4)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) 10:06:43 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000000100)=[{{&(0x7f0000000080)=@un=@file={0x0, './file0\x00'}, 0x80, &(0x7f0000001600), 0x0, &(0x7f0000000180)}}, {{0x0, 0x0, &(0x7f0000002bc0), 0x0, &(0x7f0000000180)=[{0x10, 0x29, 0x4}], 0x10}}], 0x2, 0x0) 10:06:43 executing program 2: r0 = socket(0x800000002b, 0x1, 0x1) bind$inet6(r0, &(0x7f00000000c0)={0xa}, 0x1c) 10:06:43 executing program 3: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000180)=ANY=[], 0xfffffd97) mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0) 10:06:43 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f0000000000)) r1 = eventfd(0x0) r2 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000100)=r2) dup3(r1, r0, 0x0) 10:06:43 executing program 1: migrate_pages(0x0, 0x2, &(0x7f0000000080)=0x5, &(0x7f00000000c0)=0xdd9) 10:06:43 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000280)) 10:06:43 executing program 6: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r2) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x127) close(r0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x0, 0x0, 0x3}, 0x2c) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x13f) close(r3) 10:06:43 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000), 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) [ 132.448735] attempt to access beyond end of device [ 132.453858] loop3: rw=1, want=130, limit=112 [ 132.458565] Buffer I/O error on dev loop3, logical block 129, lost async page write [ 132.466530] attempt to access beyond end of device [ 132.471602] loop3: rw=1, want=131, limit=112 [ 132.476108] Buffer I/O error on dev loop3, logical block 130, lost async page write [ 132.484095] attempt to access beyond end of device [ 132.489090] loop3: rw=1, want=132, limit=112 [ 132.493544] Buffer I/O error on dev loop3, logical block 131, lost async page write [ 132.501383] attempt to access beyond end of device [ 132.506341] loop3: rw=1, want=133, limit=112 [ 132.510790] Buffer I/O error on dev loop3, logical block 132, lost async page write [ 132.518634] attempt to access beyond end of device [ 132.523618] loop3: rw=1, want=142, limit=112 [ 132.528051] Buffer I/O error on dev loop3, logical block 141, lost async page write [ 132.535893] attempt to access beyond end of device [ 132.540854] loop3: rw=1, want=143, limit=112 [ 132.545313] Buffer I/O error on dev loop3, logical block 142, lost async page write [ 132.553171] attempt to access beyond end of device [ 132.558132] loop3: rw=1, want=144, limit=112 [ 132.562579] Buffer I/O error on dev loop3, logical block 143, lost async page write [ 132.570433] attempt to access beyond end of device [ 132.575394] loop3: rw=1, want=145, limit=112 [ 132.580407] Buffer I/O error on dev loop3, logical block 144, lost async page write [ 132.591538] attempt to access beyond end of device [ 132.596490] loop3: rw=1, want=4241, limit=112 [ 132.605561] attempt to access beyond end of device [ 132.610511] loop3: rw=1, want=8337, limit=112 [ 132.619331] attempt to access beyond end of device [ 132.624311] loop3: rw=1, want=12433, limit=112 [ 132.632978] attempt to access beyond end of device [ 132.637951] loop3: rw=1, want=16529, limit=112 [ 132.646611] attempt to access beyond end of device [ 132.651557] loop3: rw=1, want=20625, limit=112 [ 132.660459] attempt to access beyond end of device [ 132.665418] loop3: rw=1, want=24721, limit=112 [ 132.673806] attempt to access beyond end of device [ 132.678770] loop3: rw=1, want=28817, limit=112 [ 132.687392] attempt to access beyond end of device [ 132.692362] loop3: rw=1, want=32889, limit=112 10:06:44 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() clone(0x50800000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000240)) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_delete(0x0) 10:06:44 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x8f, 0x0, [0x2]}) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000340)="66b80d0000000f23c00f21f86635010002000f23f8f4baf80c66b89aaa128c66efbafc0cedbaf80c66b8cc44728666efbafc0c66b851da000066eff20f78e9fa0e0f01cabaf80c66b85962a38e66efbafc0cb002ee660fd2f2f082710952baf80c66b8d1394d8666efbafc0cec"}], 0xc0, 0xfffffffffffffffc, &(0x7f0000000300), 0x1000000000000449) ioctl$KVM_RUN(r3, 0xae80, 0x0) 10:06:44 executing program 1: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="0047fc2f07d82c99240970") getrandom(&(0x7f00000000c0), 0x0, 0x2) 10:06:44 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") keyctl$set_reqkey_keyring(0x17, 0x1) 10:06:44 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x4000) 10:06:44 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000), 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) 10:06:44 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc-cast6-avx)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000028c0)="b7f2288a933d66593ae164c990a0028e", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)={'#! ', './file0', [{0x20, 'cts(cbc-cast6-avx)\x00'}], 0xa, "058a"}, 0x21) read(r1, &(0x7f0000000bc0)=""/93, 0x3d) 10:06:44 executing program 3: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000180)=ANY=[], 0xfffffd97) mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0) 10:06:44 executing program 6: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0x1d, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='-bdev\\em1\\\x00') 10:06:44 executing program 0: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x10000008912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'bridge0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'bridge0\x00', 0x7ffffffffffffff5}) 10:06:44 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") clone(0x0, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCFLSH(r1, 0x5413, 0x706ffc) [ 133.032910] IPVS: ftp: loaded support on port[0] = 21 10:06:44 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) r1 = dup(r0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$TCXONC(r1, 0x4004af07, 0x0) [ 133.204627] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.211966] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.280306] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.286756] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.293466] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.299874] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.306625] device bridge0 entered promiscuous mode [ 133.315995] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 133.355746] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.362261] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.369894] device bridge0 left promiscuous mode [ 133.377714] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.384275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.390980] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.397376] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.404138] device bridge0 entered promiscuous mode [ 133.410361] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 133.456387] IPVS: ftp: loaded support on port[0] = 21 10:06:45 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() clone(0x50800000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000240)) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_delete(0x0) 10:06:45 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)) r2 = syz_open_pts(r1, 0x0) read(r2, &(0x7f00000000c0)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)=0xe) ioctl$TCFLSH(r2, 0x540b, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 10:06:45 executing program 1: r0 = socket(0xa, 0x2000000001, 0x0) getsockopt(r0, 0x0, 0x53, &(0x7f0000000000)=""/8, &(0x7f0000000ffc)=0x8) 10:06:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000003b00)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000003ac0)={&(0x7f00000002c0)=@bridge_getneigh={0x20, 0x1e, 0x301, 0x0, 0x0, {0x7}}, 0x20}, 0x1}, 0x0) recvmsg(r0, &(0x7f0000000400)={&(0x7f00000001c0)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000280), 0x0, &(0x7f0000000300)=""/202, 0xca}, 0x0) 10:06:45 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) close(r1) 10:06:45 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() clone(0x50800000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000240)) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_delete(0x0) 10:06:45 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) dup2(r1, r2) 10:06:45 executing program 3: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000180)=ANY=[], 0xfffffd97) mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0) [ 133.985055] attempt to access beyond end of device [ 133.990073] loop3: rw=1, want=114, limit=112 [ 133.994520] Buffer I/O error on dev loop3, logical block 113, lost async page write [ 134.002813] attempt to access beyond end of device [ 134.007919] loop3: rw=1, want=115, limit=112 [ 134.012361] Buffer I/O error on dev loop3, logical block 114, lost async page write 10:06:45 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) close(r1) [ 134.061052] attempt to access beyond end of device [ 134.066139] loop3: rw=1, want=116, limit=112 [ 134.070978] attempt to access beyond end of device [ 134.076092] loop3: rw=1, want=117, limit=112 [ 134.080835] attempt to access beyond end of device [ 134.086064] loop3: rw=1, want=130, limit=112 [ 134.093415] attempt to access beyond end of device [ 134.098494] loop3: rw=1, want=131, limit=112 10:06:45 executing program 1: r0 = socket$inet6(0xa, 0x801, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000180)="006ffc2f07d82c99240970") setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in, @in6=@loopback={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1=0xe0000001, 0x4d6, 0x2b}, 0x0, @in=@rand_addr, 0x0, 0x0, 0x0, 0x251}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa}, 0x1c) 10:06:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0054fc2f07d82c99240970") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x0, &(0x7f0000000080)) ioctl$sock_bt_hci(r1, 0x400448df, &(0x7f00000011c0)) [ 134.140538] IPVS: ftp: loaded support on port[0] = 21 [ 134.148556] attempt to access beyond end of device [ 134.153700] loop3: rw=1, want=132, limit=112 [ 134.174978] IPVS: ftp: loaded support on port[0] = 21 [ 134.175182] attempt to access beyond end of device [ 134.185326] loop3: rw=1, want=133, limit=112 [ 134.261147] attempt to access beyond end of device [ 134.266253] loop3: rw=1, want=4237, limit=112 10:06:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000014c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000004fc0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000004f80)={&(0x7f0000000080)={0x5c, r1, 0x1, 0x0, 0x0, {0x4001}, [{{0x8, 0x1, r2}, {0x40, 0x2, [{0x3c, 0x8, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6}}}]}}]}, 0x5c}, 0x1}, 0x0) 10:06:46 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) close(r1) [ 134.311456] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.334788] attempt to access beyond end of device [ 134.339915] loop3: rw=1, want=8333, limit=112 10:06:46 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(crct10dif-generic,chacha20-simd)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100), 0x0) [ 134.414723] attempt to access beyond end of device [ 134.419806] loop3: rw=1, want=12429, limit=112 10:06:46 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() clone(0x50800000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000240)) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_delete(0x0) [ 134.488512] attempt to access beyond end of device [ 134.493592] loop3: rw=1, want=16469, limit=112 [ 134.549889] attempt to access beyond end of device [ 134.554975] loop3: rw=1, want=16470, limit=112 [ 134.583348] attempt to access beyond end of device [ 134.588433] loop3: rw=1, want=16471, limit=112 [ 134.593762] attempt to access beyond end of device 10:06:46 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000180)={r3}) dup2(r0, r3) [ 134.598888] loop3: rw=1, want=16472, limit=112 [ 134.605134] attempt to access beyond end of device [ 134.610165] loop3: rw=1, want=16473, limit=112 [ 134.615198] attempt to access beyond end of device [ 134.620228] loop3: rw=1, want=16502, limit=112 [ 134.645686] attempt to access beyond end of device [ 134.650731] loop3: rw=1, want=16503, limit=112 [ 134.679526] attempt to access beyond end of device [ 134.684593] loop3: rw=1, want=16504, limit=112 [ 134.695915] attempt to access beyond end of device [ 134.700944] loop3: rw=1, want=16505, limit=112 [ 134.712703] attempt to access beyond end of device [ 134.718461] loop3: rw=1, want=16526, limit=112 [ 134.755635] attempt to access beyond end of device [ 134.760719] loop3: rw=1, want=16527, limit=112 [ 134.769281] attempt to access beyond end of device [ 134.774391] loop3: rw=1, want=16528, limit=112 [ 134.780290] attempt to access beyond end of device [ 134.785320] loop3: rw=1, want=16529, limit=112 [ 134.808572] IPVS: ftp: loaded support on port[0] = 21 [ 134.810252] attempt to access beyond end of device [ 134.818858] loop3: rw=1, want=16578, limit=112 [ 134.831733] attempt to access beyond end of device [ 134.836836] loop3: rw=1, want=16579, limit=112 [ 134.841582] attempt to access beyond end of device [ 134.846731] loop3: rw=1, want=16580, limit=112 [ 134.857731] attempt to access beyond end of device [ 134.862848] loop3: rw=1, want=16581, limit=112 [ 134.874493] attempt to access beyond end of device [ 134.879536] loop3: rw=1, want=20685, limit=112 [ 134.886787] attempt to access beyond end of device [ 134.891808] loop3: rw=1, want=21117, limit=112 10:06:47 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) close(r1) 10:06:47 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e00)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x2}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETAF(r1, 0x5412, &(0x7f00000000c0)={0x1a}) 10:06:47 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() clone(0x50800000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000240)) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_delete(0x0) 10:06:47 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x10, 0xffffffffffffffff, 0x0) ioctl$BLKRRPART(r0, 0x125f, 0x0) 10:06:47 executing program 4: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev={0xac, 0x14}}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000040)={r1}, &(0x7f0000000100)=0x2b) 10:06:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00') write$cgroup_pid(r0, &(0x7f0000000000)={[0x2d, 0x31, 0x37]}, 0x3) 10:06:47 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) dup2(r1, r2) 10:06:47 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() clone(0x50800000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000240)) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_delete(0x0) [ 135.808057] attempt to access beyond end of device [ 135.813074] loop3: rw=1, want=114, limit=112 [ 135.824093] attempt to access beyond end of device [ 135.829094] loop3: rw=1, want=115, limit=112 [ 135.833758] attempt to access beyond end of device [ 135.838755] loop3: rw=1, want=116, limit=112 [ 135.843758] attempt to access beyond end of device [ 135.848771] loop3: rw=1, want=117, limit=112 [ 135.853873] attempt to access beyond end of device [ 135.858926] loop3: rw=1, want=130, limit=112 [ 135.869083] attempt to access beyond end of device [ 135.874178] loop3: rw=1, want=131, limit=112 [ 135.879923] attempt to access beyond end of device [ 135.885837] loop3: rw=1, want=132, limit=112 10:06:47 executing program 1: perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000003, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x20000000001, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8901, &(0x7f0000000000)={"65727370616e3000000000000200"}) 10:06:47 executing program 2: r0 = socket$inet(0x10, 0x3, 0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000100007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 10:06:47 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xd, 0x0, 0x4, 0x0, 0x2000000000000006}, 0x2c) [ 135.954838] attempt to access beyond end of device [ 135.955086] IPVS: ftp: loaded support on port[0] = 21 [ 135.959893] loop3: rw=1, want=133, limit=112 [ 135.980286] IPVS: ftp: loaded support on port[0] = 21 [ 135.980559] attempt to access beyond end of device [ 135.990673] loop3: rw=1, want=4237, limit=112 [ 136.012708] attempt to access beyond end of device [ 136.017770] loop3: rw=1, want=8333, limit=112 [ 136.029801] attempt to access beyond end of device [ 136.034874] loop3: rw=1, want=12429, limit=112 [ 136.047041] attempt to access beyond end of device [ 136.052079] loop3: rw=1, want=16525, limit=112 [ 136.064433] attempt to access beyond end of device [ 136.069491] loop3: rw=1, want=20621, limit=112 10:06:47 executing program 2: r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000840)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) ioctl$int_in(r0, 0x5421, &(0x7f0000000900)=0x6) sendto$inet(r0, &(0x7f0000000000)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a6b03fbe9c0ec68357e1fbe52ed77b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b55548b845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b62ed7676706d40bc5c80e376980b81", 0x481, 0x0, &(0x7f000069affb)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f00004b3fff), 0x0, 0x0, &(0x7f00002b4000)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) [ 136.117630] attempt to access beyond end of device [ 136.122768] loop3: rw=1, want=24717, limit=112 10:06:47 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000000)=0x800, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) 10:06:47 executing program 1: perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000003, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x20000000001, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8901, &(0x7f0000000000)={"65727370616e3000000000000200"}) [ 136.157905] attempt to access beyond end of device [ 136.163730] loop3: rw=1, want=28813, limit=112 [ 136.190699] attempt to access beyond end of device [ 136.195812] loop3: rw=1, want=32885, limit=112 10:06:47 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() clone(0x50800000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000240)) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_delete(0x0) 10:06:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x60, r1, 0x201, 0x0, 0x0, {0x1}, [{{0x8, 0x1, r2}, {0x44, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4}}, {0x8, 0x6}}}]}}]}, 0x60}, 0x1}, 0x0) [ 136.499581] netlink: 'syz-executor2': attribute type 3 has an invalid length. [ 136.503415] IPVS: ftp: loaded support on port[0] = 21 10:06:48 executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000651ff8)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f000079efe0)={0x1}, 0x20) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00001a7fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}], 0x1c) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000080), 0x8) sendto$inet6(r0, &(0x7f0000aaff09)="b8", 0x1, 0x0, &(0x7f0000ab0000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) 10:06:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000003, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x20000000001, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8901, &(0x7f0000000000)={"65727370616e3000000000000200"}) 10:06:48 executing program 6: fstat(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = getuid() fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', r1, r0, 0x400) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000580)='/dev/hwrng\x00', 0x10000, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r2, 0x80605414, &(0x7f0000001980)=""/4096) r3 = accept4$nfc_llcp(0xffffffffffffff9c, 0x0, &(0x7f0000000640), 0x800) fcntl$setpipe(r3, 0x407, 0x3) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ifreq(r5, 0x8b93, &(0x7f0000000080)={'tunl0\x00', @ifru_data=&(0x7f0000000040)="615b5d78f7764d4c09fedf2a53ac6312f89297c92dc0fd0ec831b10532efde46"}) r6 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) setresgid(r0, r0, r0) ioctl$LOOP_CHANGE_FD(r6, 0x4c06, r4) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f00003b9fdc)) ioctl$TCSETS(r7, 0x5402, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3}) r8 = syz_open_pts(r7, 0x0) ioctl$TIOCGLCKTRMIOS(r8, 0x5412, &(0x7f0000000000)={0x3}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000180)={0x0, 0x0, 0x400}, &(0x7f00000002c0)=0x18) r10 = openat$audio(0xffffffffffffff9c, &(0x7f0000000500)='/dev/audio\x00', 0x101880, 0x0) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r10, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={r9, 0x1000}, 0x5) io_setup(0x8, &(0x7f0000000040)) r11 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/dsp\x00', 0x10002, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r11, 0x10e, 0x5, &(0x7f0000000440)=0x7, 0x4) r12 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x0, 0x1) getsockopt$inet_sctp_SCTP_NODELAY(r12, 0x84, 0x3, &(0x7f0000000380), &(0x7f00000003c0)=0x4) syz_open_dev$sndpcmc(&(0x7f0000000140)='/dev/snd/pcmC#D#c\x00', 0x32, 0x880) dup3(r4, r4, 0x0) eventfd(0x8) 10:06:48 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) dup2(r1, r2) 10:06:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0047fc2f07d82c99240970") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000100)='./file0\x00', 0xffffffff, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c0b4a40200010000100000000000000000000000000c0908040c", 0x7d}], 0x0, &(0x7f00000001c0)) 10:06:48 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(khazad-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000028c0)="b7f2288a933d66593ae164c990a0028e", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmsg(r1, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000002c0)=""/4096, 0x1000}], 0x34, &(0x7f0000001400)=""/123, 0x7b}, 0x0) 10:06:48 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@nested={0x4, 0xe}]}, 0x18}, 0x1}, 0x0) 10:06:48 executing program 3: r0 = socket$kcm(0xa, 0x6, 0x0) setsockopt$sock_attach_bpf(r0, 0x10d, 0xd, &(0x7f00000000c0), 0x69b) 10:06:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000003, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x20000000001, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8901, &(0x7f0000000000)={"65727370616e3000000000000200"}) 10:06:48 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@nested={0x4, 0xe}]}, 0x18}, 0x1}, 0x0) 10:06:48 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") futex(&(0x7f000000cffc)=0x4, 0x80000000010b, 0x4, &(0x7f0000000180)={0x77359400, 0x4}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000c44000)={0x77359400}, &(0x7f0000048000), 0x0) 10:06:48 executing program 3: r0 = gettid() setpgid(r0, 0x0) 10:06:48 executing program 6: setrlimit(0x8, &(0x7f00000a3ff0)) r0 = socket(0x40000000015, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(0x0, r1) mlock(&(0x7f0000911000/0x2000)=nil, 0x2000) [ 137.105390] XFS (loop2): Mounting V4 Filesystem [ 137.125404] XFS (loop2): totally zeroed log [ 137.146377] XFS (loop2): Metadata corruption detected at xfs_agi_verify+0x187/0x4f0, xfs_agi block 0x2 [ 137.156110] XFS (loop2): Unmount and run xfs_repair [ 137.161176] XFS (loop2): First 128 bytes of corrupted metadata buffer: [ 137.167879] 0000000001d96e05: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.176758] 0000000074a47b15: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.185625] 00000000d238536e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.194509] 0000000037b7227c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.203387] 00000000d6610615: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.212281] 00000000e135159a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.221158] 000000008ca51f25: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.230060] 00000000bb6e6b0c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10:06:48 executing program 3: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = syz_open_dev$dspn(&(0x7f0000004ff6)='/dev/dsp#\x00', 0x1, 0x0) poll(&(0x7f00000000c0)=[{r1}], 0x1, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000006ff8)) mmap$binder(&(0x7f0000710000/0x1000)=nil, 0x1000, 0xfffffffffffff399, 0x12, r1, 0x0) [ 137.239168] XFS (loop2): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x2 len 1 error 117 [ 137.248609] XFS (loop2): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -117, agno 0 [ 137.257184] XFS (loop2): failed to read root inode 10:06:49 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@nested={0x4, 0xe}]}, 0x18}, 0x1}, 0x0) [ 137.399570] XFS (loop2): Mounting V4 Filesystem [ 137.407755] XFS (loop2): totally zeroed log [ 137.413998] XFS (loop2): Metadata corruption detected at xfs_agi_verify+0x187/0x4f0, xfs_agi block 0x2 [ 137.423638] XFS (loop2): Unmount and run xfs_repair [ 137.428691] XFS (loop2): First 128 bytes of corrupted metadata buffer: [ 137.435380] 00000000bad6a7f1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.444268] 000000006e18c2d5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.453126] 00000000c5f3b33c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.462035] 00000000809f6d70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.470956] 00000000ec40e05f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.479862] 0000000016d14074: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.488728] 0000000044803dee: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.497603] 00000000a721041b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 137.506576] XFS (loop2): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x2 len 1 error 117 [ 137.516005] XFS (loop2): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -117, agno 0 [ 137.524560] XFS (loop2): failed to read root inode 10:06:49 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x24, &(0x7f0000001000)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d03010000000000950000000000000071260000000000003506000002000000bf25000000000000070500000e0000000f65000000000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf250000000000000f65000000000000070500000e000000bf5400000000000007040000040000003d4301000000000095000000000000006154000000000000bf25000000000000070500000e0000000f6500000000000007050000040000000f65000000000000bf5400000000000007040000040000003d3201000000000095000000000000004d54000000000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) 10:06:49 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000cb9ffc)=0x1, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='bbr\x00', 0x4) bind$inet(r0, &(0x7f0000c16ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000fa0fff), 0xffffffffffffffc3, 0x20020007, &(0x7f0000e97fcf)={0x2, 0x1, @loopback=0x7f000001}, 0x10) 10:06:49 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fanotify_init(0xc, 0x0) 10:06:49 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4}, [@nested={0x4, 0xe}]}, 0x18}, 0x1}, 0x0) 10:06:49 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-avx\x00'}, 0x58) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000200)="0047fc2f07d82c99240970") r2 = accept4(r0, 0x0, &(0x7f0000000040), 0x0) sendmsg$rds(r2, &(0x7f0000000300)={&(0x7f0000000000)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/148, 0x94}, {&(0x7f00000008c0)=""/4096, 0x1000}], 0x2, &(0x7f00000006c0)}, 0x0) 10:06:49 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) creat(&(0x7f000009aff8)='./file0\x00', 0x0) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:49 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") futex(&(0x7f000000cffc)=0x4, 0x80000000010b, 0x4, &(0x7f0000000180)={0x77359400, 0x4}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000c44000)={0x77359400}, &(0x7f0000048000), 0x0) 10:06:49 executing program 5: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") fchdir(r0) r2 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) ftruncate(r2, 0xfffc) r3 = dup(r2) r4 = open(&(0x7f00000008c0)='./file0\x00', 0x0, 0x0) sendfile(r3, r4, &(0x7f0000d83ff8), 0x2008000fffffffe) 10:06:49 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) creat(&(0x7f000009aff8)='./file0\x00', 0x0) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:49 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000000)="d3", 0x1, 0x0) 10:06:49 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x2000008912, &(0x7f00000000c0)="0047fc2f07d82c99240970") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000280)=@filter={'filter\x00', 0xe, 0x1, 0x160, [0x0, 0x20000340, 0x20000370, 0x200003a0], 0x0, &(0x7f0000000000), &(0x7f0000000340)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000001500000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000001900000002000000080062725964676530000000000000000000696662300000000000000000000000d300000000000000000000000000ff7f0000000000006e300000000000000000000180c2000000000000000000aaaaaaaaaabb00000000000000007000000070000000a00000004e46515545554500000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000f700000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x1d8) r2 = socket$inet6(0xa, 0x100000002, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0xd}, 0x1c) sendto$inet6(r2, &(0x7f0000000300), 0xfd90, 0x400806e, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1c) sendto$inet6(r2, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 10:06:49 executing program 3: capset(&(0x7f0000000340)={0x19980330}, &(0x7f0000000080)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x84, &(0x7f0000000340), &(0x7f0000000400)=""/132}, 0x28) [ 138.330338] FAT-fs (loop5): error, invalid access to FAT (entry 0x00000045) [ 138.337807] FAT-fs (loop5): Filesystem has been set read-only 10:06:50 executing program 4: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x1000}, 0x1c) bind$inet6(r1, &(0x7f000044f000)={0xa, 0x4e20}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, &(0x7f00000002c0)) 10:06:50 executing program 6: msgsnd(0x0, &(0x7f0000000080), 0x8, 0x0) msgrcv(0x0, &(0x7f0000000240)={0x0, ""/79}, 0x20000307, 0x0, 0xa4a3ad41a879dde0) [ 138.378806] FAT-fs (loop5): error, invalid access to FAT (entry 0x00000045) 10:06:50 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x10000000000027a}]}) 10:06:50 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) creat(&(0x7f000009aff8)='./file0\x00', 0x0) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:50 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffe000/0x2000)=nil) shmctl$SHM_LOCK(r0, 0xb) 10:06:50 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_emit_ethernet(0x7e, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x2, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14}, {[@timestamp={0x44, 0x40, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2=0xe0000002]}, {[@multicast1=0xe0000001]}, {}, {[@loopback=0x7f000001]}, {[@broadcast=0xffffffff]}, {[@multicast1=0xe0000001]}, {[@dev={0xac, 0x14, 0x14}]}]}]}}}}}}}, &(0x7f0000000000)) 10:06:50 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x2000080000089a2, &(0x7f0000000040)={'bridge0\x00', @ifru_map}) 10:06:50 executing program 6: r0 = socket$kcm(0x29, 0x1000000000005, 0x0) ioctl(r0, 0x80000008912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='numa_maps\x00') mbind(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x8003, &(0x7f0000000080)=0x3, 0x63, 0x0) readv(r1, &(0x7f0000000300)=[{&(0x7f0000001400)=""/4096, 0x1000}], 0x1) 10:06:50 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe803, 0x1, &(0x7f0000000440)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010a0200027400f801", 0x17}], 0x0, &(0x7f0000000180)=ANY=[]) mknod(&(0x7f0000000080)='./file0/fi.e0 ', 0x0, 0x0) 10:06:50 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_emit_ethernet(0x7e, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x2, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14}, {[@timestamp={0x44, 0x40, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2=0xe0000002]}, {[@multicast1=0xe0000001]}, {}, {[@loopback=0x7f000001]}, {[@broadcast=0xffffffff]}, {[@multicast1=0xe0000001]}, {[@dev={0xac, 0x14, 0x14}]}]}]}}}}}}}, &(0x7f0000000000)) 10:06:50 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)=',+nodev:!eth1\x00', 0xe, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) sendto$inet(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f000057bff0)={0x2, 0x4e20, @multicast1=0xe000000d}, 0x10) 10:06:50 executing program 3: r0 = socket$kcm(0x29, 0x5, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x1ff, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r2 = syz_open_dev$evdev(&(0x7f00000009c0)='/dev/input/event#\x00', 0x0, 0x0) dup3(r2, r1, 0x0) 10:06:50 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") futex(&(0x7f000000cffc)=0x4, 0x80000000010b, 0x4, &(0x7f0000000180)={0x77359400, 0x4}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000c44000)={0x77359400}, &(0x7f0000048000), 0x0) 10:06:50 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x615}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000100)=0x1e) [ 139.176646] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 139.201848] FAT-fs (loop4): Directory bread(block 2563) failed 10:06:50 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_emit_ethernet(0x7e, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x2, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14}, {[@timestamp={0x44, 0x40, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2=0xe0000002]}, {[@multicast1=0xe0000001]}, {}, {[@loopback=0x7f000001]}, {[@broadcast=0xffffffff]}, {[@multicast1=0xe0000001]}, {[@dev={0xac, 0x14, 0x14}]}]}]}}}}}}}, &(0x7f0000000000)) 10:06:50 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:50 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000180)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg$rds(r0, &(0x7f0000001f40)={&(0x7f0000000080)={0x2, 0x0, @rand_addr=0x5}, 0x10, &(0x7f0000000500), 0x0, &(0x7f0000001e80)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f0000000580)=""/4096, 0x1000}, &(0x7f0000001b40)=[{&(0x7f0000001ac0)=""/88, 0x58}], 0x1, 0x60}}], 0x48}, 0x0) [ 139.249402] FAT-fs (loop4): Directory bread(block 2564) failed [ 139.288867] FAT-fs (loop4): Directory bread(block 2565) failed 10:06:50 executing program 6: mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x4001b071, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000002dff8)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000001f4c), 0x4000000000001b9, 0x0, 0x0) sendto(r1, &(0x7f0000018000)="f8", 0x1, 0x0, 0x0, 0x0) 10:06:50 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x615}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000100)=0x1e) 10:06:50 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00') write$cgroup_pid(r0, &(0x7f0000000200)={[0x33, 0x39]}, 0x2) [ 139.307876] FAT-fs (loop4): Directory bread(block 2566) failed [ 139.316455] FAT-fs (loop4): Directory bread(block 2567) failed [ 139.325224] FAT-fs (loop4): Directory bread(block 2568) failed [ 139.331704] FAT-fs (loop4): Directory bread(block 2569) failed [ 139.338321] FAT-fs (loop4): Directory bread(block 2570) failed [ 139.346473] FAT-fs (loop4): Directory bread(block 2571) failed [ 139.353568] FAT-fs (loop4): Directory bread(block 2572) failed 10:06:51 executing program 4: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xd0, &(0x7f0000000040), 0x2) [ 139.459640] rdma_op 0000000023ffd6e3 conn xmit_rdma (null) 10:06:51 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x615}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000100)=0x1e) 10:06:51 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") syz_emit_ethernet(0x7e, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x2, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14}, {[@timestamp={0x44, 0x40, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2=0xe0000002]}, {[@multicast1=0xe0000001]}, {}, {[@loopback=0x7f000001]}, {[@broadcast=0xffffffff]}, {[@multicast1=0xe0000001]}, {[@dev={0xac, 0x14, 0x14}]}]}]}}}}}}}, &(0x7f0000000000)) 10:06:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0xfffffffffffffffc, 0x20011, r2, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000003600)='net/netfilter\x00') [ 139.705569] binder_alloc: binder_alloc_mmap_handler: 9490 20000000-20002000 already mapped failed -16 10:06:51 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='memory.stat\x00', 0x0, 0x0) read$eventfd(r1, &(0x7f00000000c0), 0xfea4) 10:06:51 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$inet6(0xa, 0x8001000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r4 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) syz_kvm_setup_cpu$x86(r4, r2, &(0x7f000000c000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000080)="f20f2d7e00c4e3bd40ce630f07f7cd0c000000660f01c90ff8cd0fc7588ab8ad6e00000f23d80f21f835000000c00f23f8c4e3cd6971f500f20f08", 0x3b}], 0x1, 0x0, &(0x7f0000000100), 0x0) 10:06:51 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000006580)=[{{&(0x7f0000001c40)=@sco, 0x80, &(0x7f0000002000)=[{&(0x7f0000001f40)=""/26, 0x1a}, {&(0x7f0000001f80)=""/68, 0x44}], 0x2, &(0x7f0000002080)=""/77, 0x4d}}], 0x1, 0x0, &(0x7f00000067c0)) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(blowfish-generic)\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffcbe, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5", 0x4) sendto$llc(r1, &(0x7f0000000080)="57860e17f91a8bf2", 0x8, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400}) 10:06:51 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") futex(&(0x7f000000cffc)=0x4, 0x80000000010b, 0x4, &(0x7f0000000180)={0x77359400, 0x4}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000c44000)={0x77359400}, &(0x7f0000048000), 0x0) 10:06:51 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x615}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000100)=0x1e) 10:06:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000100)="0047fc2f07d82c99240970") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'veth1_to_bond\x00', &(0x7f0000000000)=@ethtool_stats={0x4a}}) close(r2) close(r1) 10:06:51 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:51 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000024000)={0x10}, 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)={0x20, 0x27, 0xaff, 0x0, 0x0, {0x5}, [@nested={0xc, 0x1, [@typed={0x8, 0x1, @binary}]}]}, 0x233}, 0x1}, 0x0) 10:06:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) fsetxattr(r0, &(0x7f0000000000)=@known='security.capability\x00', &(0x7f0000000040)="0000000379706527000000040000000700002045ffffffff", 0x18, 0x0) 10:06:52 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 10:06:52 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x3f) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x4}, 0x1c) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r2 = syz_open_procfs(0x0, &(0x7f0000000240)="6e65742f7261773600a62d807c8658e05076d7104ca3f8a578d7c61219a134cf0d1bcf4cedceb57956303ed1fe1be9650ee0123cf7868fe461ac6242601b5d7ac1d260bbfa89e5efae6d39c00f604a08fda598dd470cc89d44c205ec05afb784e1f0a01fda3feafb3ce77bc52e6ca3c262c838db2fb92f87ab310a5593269fc173a2b7fc01e2061762304f2156ffefa23d40d2b23c12bb817e89237fe91afe2271709960a41fbb87337be1d0f9e98d") socket$inet6(0xa, 0x3, 0x3) sendfile(r0, r2, &(0x7f0000000300), 0x8001) 10:06:52 executing program 6: r0 = socket(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x0) ioctl$sock_ifreq(r0, 0x89f2, &(0x7f0000000240)={'sit0\x00', @ifru_data=&(0x7f0000000000)="00b4ae9fca19fba868f03158de8d12d04ed14126c514de7b02ade828cb2a0180"}) 10:06:52 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local={0x1, 0x80, 0xc2}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0xe803, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x29, 0x0, @empty, @broadcast=0xffffffff}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) [ 140.889913] sit: non-ECT from 0.0.0.0 with TOS=0x3 [ 140.899629] sit: non-ECT from 0.0.0.0 with TOS=0x3 10:06:52 executing program 5: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_netrom_TIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) 10:06:52 executing program 3: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x1, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f00000001c0)) write$sndseq(r1, &(0x7f0000000200)=[{0x81, 0x5, 0x0, 0x0, @tick, {}, {}, @raw8={"959546592b83c98a10d789af"}}], 0x30) 10:06:52 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000ff7)='/dev/ppp\x00', 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000001000)=[{&(0x7f0000000040)='\x00\x00', 0x2}], 0x1, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000001000)=""/246) ioctl$EVIOCGREP(r0, 0x4010744d, &(0x7f0000001000)=""/174) 10:06:52 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ion\x00', 0x0, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl(r1, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x8004, 0x1a, 0x1, 0xffffffffffffffff}) r3 = dup3(r0, r2, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000080)={0x101000000, 0xa}) 10:06:52 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:52 executing program 1: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xa) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r1, 0x800455d1, &(0x7f00000000c0)) 10:06:52 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000f43ffc)=0x8000000000000001, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x15, &(0x7f0000000000), 0x4) 10:06:52 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r0, &(0x7f0000000100)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "8811e78754fe8a427be2784032d1b714a23f86cdc834bc921c0525fec2021e21cc027f1d28fc5ba98c513afc8ce465aa9a9d325ebac7627ffe7a55cdbd77b3"}, 0x60) getpeername$llc(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x10) 10:06:52 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970") r1 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0xfffffffffffffffc, 0x5) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000080)={0x1}) write$binfmt_elf32(r1, &(0x7f0000000280)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, 0x0, 0x1, 0x64, 0x2}, [{}]}, 0x3d8) 10:06:52 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x101, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff}) lseek(r1, 0x0, 0x0) 10:06:53 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000022000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, &(0x7f00000002c0)="48b801000000000000000f23c00f21f835020004000f23f8b9c70200000f32f0460fc78868cc0000b8010000000f01c166b8f8000f00d866bad00466b8c26266efc441adfedcc4c19855a804000000460f1a7d046436640f07", 0x59}], 0x1, 0x0, &(0x7f0000000380), 0x1000000000000043) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:53 executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000223fd4)=[@in6={0xa, 0x4e23}], 0x1c) sendto$inet6(r0, &(0x7f0000000180)="97", 0x1, 0x0, &(0x7f00006f9000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendmmsg(r0, &(0x7f0000001080)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000300)="cc", 0x1}], 0x1, &(0x7f0000000480)}}, {{&(0x7f0000000500)=@in={0x2}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000580)='E', 0x1}], 0x1}}], 0x2, 0x0) 10:06:53 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:53 executing program 4: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="c626262c8523bf012cf66f") prctl$void(0x7) 10:06:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x80000000000046, 0x0) poll(&(0x7f0000000000)=[{r1}, {r1, 0x100e}, {r1}], 0x3, 0x0) 10:06:53 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$seccomp(0x16, 0x1, &(0x7f0000000300)={0x0, &(0x7f00000002c0)}) 10:06:53 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) write$binfmt_script(r1, &(0x7f0000000480)={'#! ', './file0', [], 0xa}, 0xb) 10:06:53 executing program 4: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047"}], 0x0, 0x0, &(0x7f0000000080), 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb034d564b0000000001"]) ioctl$KVM_X86_SET_MCE(r3, 0x4008ae89, &(0x7f0000000140)={0x2, 0x400000b1}) 10:06:53 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x101, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff}) lseek(r1, 0x0, 0x0) 10:06:53 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f00000003c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="4000dfff5238"], &(0x7f0000000340)=0x2) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x0, 0x0, &(0x7f0000000040), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) pipe2(&(0x7f0000000000), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000003000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000140)="2e470f01ca420f01d666470f56421fc4211610ee640f01d10f0178f443dbe166ba4200b0e8eeb805000000b9050000000f01c1b9800000c00f3235000100000f30", 0x41}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = socket(0xa, 0x1, 0x0) ioctl(r3, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 141.591745] audit: type=1326 audit(1528366013.218:5): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9599 comm="syz-executor0" exe="/root/syz-executor0" sig=9 arch=c000003e syscall=202 compat=0 ip=0x455a09 code=0x0 10:06:53 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000b40)=@broute={'broute\x00', 0x20, 0x3, 0x3d8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000740], 0x0, &(0x7f0000000280), &(0x7f0000000740)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x19, 0x0, 0xfbff, 'bcsh0\x00', 'teql0\x00', 'tunl0\x00', 'veth1_to_bridge\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0x0, 0x0, 0xff], 0xa0, 0xd0, 0x100, [@connlabel={'connlabel\x00', 0x8}]}, [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x80}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x2, [{{{0x9, 0x0, 0x0, 'yam0\x00', 'teql0\x00', 'veth0_to_bond\x00', 'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0xff], @random="9bbf4bcd25bf", [0x0, 0x0, 0xff], 0x110, 0x110, 0x158, [@quota={'quota\x00', 0x18, {{0x0, 0x0, 0x0, 0x6}}}, @arp={'arp\x00', 0x38, {{0x0, 0x9b1c, 0x3, @broadcast=0xffffffff, 0x0, @loopback=0x7f000001, 0xffffff00, @random="fb2b130e6c29", [0x0, 0x0, 0x0, 0x0, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}, {{{0x9, 0x0, 0x0, 'tunl0\x00', 'bond_slave_0\x00', 'ip6gre0\x00', 'veth0_to_bridge\x00', @empty, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x70, 0xa0, 0xf0}, [@common=@AUDIT={'AUDIT\x00', 0x8}]}, @common=@LED={'LED\x00', 0x28, {{'syz1\x00', 0x0, 0x902, 0x8}}}}]}]}, 0x450) 10:06:53 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0054fc2f07d82c99240970") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x40000000) timer_create(0x8, &(0x7f0000000000)={0x0, 0x0, 0x1}, &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, r1+10000000}, {0x77359400}}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000004a000)={{0x0, 0x1}, {0x0, 0xe4c}}, &(0x7f0000040000)) 10:06:53 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:53 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) 10:06:53 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x101, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff}) lseek(r1, 0x0, 0x0) [ 141.869647] IPVS: ftp: loaded support on port[0] = 21 [ 141.905396] cannot load conntrack support for proto=7 10:06:53 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:53 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) ioctl(r1, 0x5387, &(0x7f00000000c0)) [ 141.979898] cannot load conntrack support for proto=7 [ 142.033122] IPVS: ftp: loaded support on port[0] = 21 10:06:53 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000005000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0x40405514, &(0x7f0000001000)) 10:06:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="8100756994094bd7f1586f") r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970") fallocate(r0, 0x0, 0x0, 0x0) 10:06:53 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='scalable\x00', 0x9) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x0) shutdown(r0, 0x1) 10:06:53 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x101, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff}) lseek(r1, 0x0, 0x0) 10:06:53 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = socket(0x10, 0x802, 0x0) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000007580)={&(0x7f0000001c40)={0x10}, 0xc, &(0x7f0000007540)={&(0x7f00000034c0)=ANY=[]}, 0x1}, 0x0) write(r1, &(0x7f0000001500)="240000001a0025f0006bb404feff141c020b5aff6e10b500001180cc0800100023020000", 0x24) 10:06:53 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) ioctl(r1, 0x5387, &(0x7f00000000c0)) 10:06:53 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") unshare(0x40000000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000300)=0x54) 10:06:53 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) [ 142.446918] IPVS: ftp: loaded support on port[0] = 21 10:06:54 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r0, 0x8, 0x0) dup2(r0, r2) 10:06:54 executing program 2: r0 = socket(0x40000000015, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(0x0, r1) r2 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r2, 0x1, &(0x7f0000000000)={{}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8}) 10:06:54 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, 0xffffffffffffffff) 10:06:54 executing program 5: syz_mount_image$ntfs(&(0x7f0000000080)='ntfs\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0), 0x0, &(0x7f00000013c0)={[{@disable_sparse_no={'disable_sparse=no', 0x3d}, 0x2c}]}) 10:06:54 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) ioctl(r1, 0x5387, &(0x7f00000000c0)) [ 142.624285] IPVS: ftp: loaded support on port[0] = 21 [ 142.675760] ntfs: (device loop5): parse_options(): The disable_sparse option requires a boolean argument. [ 142.769267] ntfs: (device loop5): parse_options(): The disable_sparse option requires a boolean argument. 10:06:55 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000580), 0x0) 10:06:55 executing program 2: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f00000000c0), 0x8) 10:06:55 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) ioctl(r1, 0x5387, &(0x7f00000000c0)) 10:06:55 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, 0xffffffffffffffff) 10:06:55 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") futex(&(0x7f000000cffc), 0x0, 0x1, &(0x7f0000cc3ff0)={0x77359400}, &(0x7f000044b000), 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000080)="d4", 0x1, 0xfffffffffffffffd) keyctl$revoke(0x3, r1) 10:06:55 executing program 0: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") ioctl$sock_ifreq(r0, 0x89fb, &(0x7f0000000100)={"626f6e643000000000041300", @ifru_names="00907000"}) 10:06:55 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12}, &(0x7f0000000000)) 10:06:55 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r0, 0x5405, 0x0) 10:06:55 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000580)='cdg\x00', 0x4) shmget$private(0x0, 0x1000, 0x1008, &(0x7f0000fff000/0x1000)=nil) 10:06:55 executing program 4: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_GET_MAP(0xffffffffffffffff, 0xc0286404, &(0x7f0000000140)={&(0x7f0000ffc000/0x3000)=nil, 0x7c97, 0x0, 0x0, &(0x7f0000ffd000/0x2000)=nil}) vmsplice(r0, &(0x7f0000000000), 0x282, 0x0) 10:06:55 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0x15040003) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}], 0x1c) 10:06:55 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r0, 0x5405, 0x0) 10:06:55 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00003b8ffc)=0x51) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000ea7000)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000f90000)={0x34d8}) 10:06:55 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 10:06:55 executing program 3: r0 = socket$inet6(0xa, 0x1000000000003, 0x2000000000000008) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") getsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000000000), &(0x7f0000000080)=0x4) 10:06:55 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000e05000)={0x2, 0xd, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@rand_addr, @in6=@mcast2={0xff, 0x2, [], 0x1}}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14}}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xa0}, 0x1}, 0x0) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x13, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) 10:06:55 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = syz_open_dev$sndseq(&(0x7f0000ff0ff3)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000418f50)={{}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4"}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f00000000c0)={0x0, @time}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85321, &(0x7f0000000280)={{}, 'port0\x00'}) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x0, 0x0) close(r1) 10:06:55 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r0, 0x5405, 0x0) 10:06:55 executing program 2: sendmmsg$unix(0xffffffffffffffff, &(0x7f0000165ee8)=[{&(0x7f00005bcffd)=@abs, 0x8, &(0x7f00003ccf80), 0x0, &(0x7f0000007000)=[@rights={0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}], 0x20}], 0x1, 0x0) r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0xda14}) ioctl(r0, 0x2285, &(0x7f0000007000)='S') 10:06:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = open(&(0x7f0000011000)='./bus\x00', 0x8000400141042, 0x0) mmap(&(0x7f0000000000/0x11000)=nil, 0x11000, 0x3, 0x11, r1, 0x0) futex(&(0x7f0000000000), 0x400000085, 0x0, &(0x7f0000001ff0), &(0x7f0000000040), 0x0) 10:06:55 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, 0xffffffffffffffff) [ 143.868906] binder: release 9767:9771 transaction 26 out, still active [ 143.875682] binder: unexpected work type, 4, not freed [ 143.881032] binder: undelivered TRANSACTION_COMPLETE [ 143.890366] binder: invalid inc weak node for 27 [ 143.895260] binder: 9767:9771 IncRefs 0 refcount change on invalid ref 1 ret -22 10:06:55 executing program 3: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x4e21}, 0x10) syz_emit_ethernet(0x423, &(0x7f000018f000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @dccp={{0x0, 0x4e21, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d73cde", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) sendto$inet(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000001940)={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) 10:06:55 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0054fc2f07d82c99240970") syz_mount_image$reiserfs(&(0x7f00000000c0)='reiserfs\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f0000000a00), 0x0, &(0x7f0000000840)={[{@jqfmt_vfsv0='jqfmt=vfsv0', 0x2c}]}) 10:06:55 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:55 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00009f3fa8)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003c1000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="28cbfccaa5302a351073180836a47644", 0x10}], 0x1, &(0x7f0000000280)}, 0x0) recvmsg(r1, &(0x7f0000000a80)={&(0x7f0000000480)=@pppol2tpin6, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)=""/1, 0x1}, {&(0x7f0000000280)=""/92, 0x5c}], 0x2, &(0x7f0000000a00)=""/111, 0xbd}, 0x0) 10:06:55 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f00000000c0)='./file0/file0\x00', 0x3fffa, 0x0) fallocate(r0, 0x1, 0x0, 0x8008) write$binfmt_elf32(r0, &(0x7f0000000740)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x20}, [{}]}, 0x58) 10:06:55 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r0, 0x5405, 0x0) [ 143.997480] binder: BINDER_SET_CONTEXT_MGR already set [ 144.023132] binder: 9767:9791 ioctl 40046207 0 returned -16 [ 144.030637] binder_alloc: 9767: binder_alloc_buf, no vma [ 144.036248] binder: 9767:9771 transaction failed 29189/-3, size 24-8 line 2967 [ 144.044230] binder: undelivered TRANSACTION_ERROR: 29189 [ 144.067937] binder: send failed reply for transaction 26, target dead [ 144.280484] REISERFS warning (device loop0): super-6502 reiserfs_getopt: unknown mount option "" [ 144.339877] REISERFS warning (device loop0): super-6502 reiserfs_getopt: unknown mount option "" 10:06:56 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='nfs4\x00', 0xa3021, 0x0) 10:06:56 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 10:06:56 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x3, 0x1) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr, @multicast1=0xe0000001}, @icmp=@address_reply={0x8}}}}}, &(0x7f0000000040)) 10:06:56 executing program 6: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000280)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mknod(&(0x7f0000000040)='./file0/file2\x00', 0xc000, 0x0) 10:06:56 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) 10:06:56 executing program 1: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) futex(&(0x7f000000cffc)=0x100000000000004, 0x0, 0x4, &(0x7f0000edfff0)={0x77359400}, &(0x7f0000048000), 0x0) r1 = semget$private(0x0, 0x6, 0x0) semop(r1, &(0x7f000002efe2)=[{0x0, 0x4}], 0x1) semop(r1, &(0x7f000001a000)=[{}], 0x1) semctl$IPC_RMID(r1, 0x0, 0x0) 10:06:56 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000004000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f0000000000)="67660f2857be66b9800000c00f326635000800000f30baf80c66b84028b08166efbafc0c66ed3e65f3ab66660f3804e2660fdfa7c9750f20c06635000000200f22c03e0f0d8ba8840f01cabaf80c66b8b3501b8666efbafc0cb0eeee", 0x5c}], 0x1, 0x0, &(0x7f00000000c0), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:56 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) r2 = dup(r0) sendto(r0, &(0x7f0000000880)="a6", 0x1, 0x8000, &(0x7f0000000980)=@vsock={0x28, 0x0, 0x0, @reserved=0x1}, 0x80) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000002840)={&(0x7f00000001c0)={0x10}, 0xc, &(0x7f0000002800)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x1}, 0x1}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x0, 0x0, 0x0, {0x8}}, 0x14}, 0x1}, 0x0) [ 144.492171] binder: release 9836:9842 transaction 31 out, still active [ 144.498985] binder: unexpected work type, 4, not freed [ 144.504357] binder: undelivered TRANSACTION_COMPLETE 10:06:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000240)={"0d48c1fedfedda2782cffab40681152b3bf9130fe9873689af4f63aeb0fbd45246146977168a29c16c0d1d5c9b91cfdac4b6cc7e8beddd032075d11104171867ecd140948d756859debeda601d44059ca6c31228e45aa5957a839151c2ea7fd0a37a51f5cbfe09f2e9822fa6c89d3eaec4b93bf1c6daf19b9b72a58b7192efc993dc01adbc0781cdff49fc6175b4bf66ba6a75042827a8e6faad508998d8b03dfb7e39c8d63fa974989d95f197d7b75ffe7b3cb607c89241337641353158fbcd3f2a6d24c7a0e74ba34016c8b97639060bd6492b6c33a0fe55237646ba600bcb84f1d7e9f9d0f790fde6ff38d9c2dd2a80e9b82867facd1cb1660a46871dfcc781e99595dd45a741f060ab602b8c67b988c33246e4043d2bff774b9dc289764a0441c0346cbb49d8020c54f5c0bbe5f4b6e0565850ef08f7f6b53d51ae948e93b0b2ee8cea54cd8a11ed54fccecb2b4008335bbe4d70fbb9c058525db6178d894a762558b5dbba9df210354d8abae5002683d9322cbbe91c14f3bbd6d833f92523563dac9fdfae51b6732bde82817612e93dac753f2a02b1db5844f60577e385846b2709a214e8b1545581e393770bcc649cfb62e07d337a88b2067b848a241295babceb908a1adbac8543d2541251daefa14a8de75f81347151c00b2b7842d86f66c3ccc924a5658b7998e803d99c14b6983980f4a308bd7c6d1d5f27b2eec9234954cf52106a505b273e9071b984e4f48c90bcc398f095e374fe1fb54b8349210b895f7bb25cf7d0a83a0722f1fca5f5b18ed3b4eb2f3f05db58ace2debe5058056764349837294a7e656e9f443ed5098d8b3d3be2f601f10871f61a8cd63889c9323bab28977d88ba0d59decb43c8835d860fe0ec656aec56bfe6485e0c2b158ffaf0bd557c5629324f5767a80dbedbf0d5c89a7de3cfc6878530f69ae862e42ad239eaa784e070b6b9613a0a138a4997930c6447a96335e6a743ce1247ae46b691c661e96f1dfdb758ce18c239e8ccd0ac82c68226b64e5211b56544dce4b7f14e0794682c817d6db335bfebdffd42e56bebf3720b9f12dc0331c0b3169792f0600fbf9e18a15b125fb437de12ed4560ff5b98e5519ec79d5c6fe86c87c40f61b1585cabe393d5f93cb796ee528f1f6a37f5931cb0b21a47eff5672ebc8097cd9a88a4ac7b2d260514316fc0093e3a102dcf5e02b4e88f54c5ed8b9c0cc0bf9e236882e224e6629c699d8281465ffbbb0f1640e95397f4d457cfe35516470a4392f3cb2ac46776404b7fa12d53c20c6be84be0c54d730b6783fdebf63bbe71ca7cc01c6807f4bd1b8454fb22dbf09540e820a9e5604439c3136f79c7945e016ff048e71ee49c746b3432feb3136d3220e8be824a058410b98e310112e75c3f097d4c6275d3dc2979309336db56c62263668d32971a08d9c263b8ada37063"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:06:56 executing program 6: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xf, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x2c) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000080), &(0x7f0000000140), 0x2}, 0x20) 10:06:56 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 10:06:56 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000040)={0x14, r1, 0x301, 0x0, 0x0, {0xb}}, 0x14}, 0x1}, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f00000001c0), &(0x7f00000000c0)=""/64}, 0x18) 10:06:56 executing program 5: clock_gettime(0x5, &(0x7f0000000080)) 10:06:56 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r1, r2) [ 144.634873] binder: send failed reply for transaction 31, target dead 10:06:56 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x43) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b20000)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x3}]}, 0x10) sendmmsg(r1, &(0x7f000070b000)=[{{0x0, 0x0, &(0x7f00007ed000)=[{&(0x7f0000d90fa7)='u', 0x1}], 0x1, &(0x7f0000275000)}}], 0x1, 0x48084) shutdown(r1, 0x1) [ 144.812928] binder: release 9866:9870 transaction 35 out, still active [ 144.819733] binder: unexpected work type, 4, not freed [ 144.825062] binder: undelivered TRANSACTION_COMPLETE [ 144.836421] binder: invalid inc weak node for 36 [ 144.841279] binder: 9866:9870 IncRefs 0 refcount change on invalid ref 1 ret -22 10:06:56 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0247e22f05d02c99240970") r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0) write$cgroup_int(r1, &(0x7f00000024c0)=ANY=[@ANYRES32], 0x4) fallocate(r1, 0x0, 0x0, 0x8000006) 10:06:56 executing program 5: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x0) ppoll(&(0x7f0000000100)=[{r0}], 0x1, &(0x7f0000000180)={0x77359400}, &(0x7f00000001c0), 0x267) syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f00000000c0)) ioctl$SG_IO(r1, 0x2285, &(0x7f0000001640)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x384c8, &(0x7f00000004c0)}, &(0x7f0000000500)="abc0b501df7e", &(0x7f0000000600)=""/4096, 0x0, 0x0, 0x0, &(0x7f0000001600)}) 10:06:56 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(0xffffffffffffffff, r1) 10:06:56 executing program 0: r0 = socket$inet6(0xa, 0x10000000003, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@local={0xfe, 0x80, [], 0xaa}, @in6=@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@loopback=0x7f000001, 0x0, 0x3c}, 0x0, @in6=@local={0xfe, 0x80, [], 0xaa}, 0x0, 0x1000000003, 0x0, 0x4}}, 0xe8) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 144.993050] binder: send failed reply for transaction 35, target dead 10:06:57 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x49, &(0x7f0000000180)={{{@in6=@mcast2={0xff, 0x2, [], 0x1}, @in=@multicast1=0xe0000001}}, {{@in=@rand_addr}, 0x0, @in=@loopback=0x7f000001}}, 0xe8) 10:06:57 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000006c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000500)}) 10:06:57 executing program 5: r0 = socket(0x2, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000480)={[], 0x0, 0x1a200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000180)={0x2, 0x0, [0x1d9, 0x1]}) 10:06:57 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x43) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b20000)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x3}]}, 0x10) sendmmsg(r1, &(0x7f000070b000)=[{{0x0, 0x0, &(0x7f00007ed000)=[{&(0x7f0000d90fa7)='u', 0x1}], 0x1, &(0x7f0000275000)}}], 0x1, 0x48084) shutdown(r1, 0x1) 10:06:57 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000040)={0x0, @empty, 0x4e24, 0x0, 'dh\x00'}, 0x2c) 10:06:57 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") semctl$IPC_SET(0x0, 0x0, 0x14, &(0x7f0000000280)) 10:06:57 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(0xffffffffffffffff, r1) 10:06:57 executing program 1: r0 = add_key(&(0x7f0000000080)='ceph\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000000), 0x1fe, 0xffffffffffffffff) keyctl$revoke(0xb, r0) 10:06:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x14, 0x1d, 0xfffffffffffffffd, 0x0, 0x0, {0x1f}}, 0x14}, 0x1}, 0x0) recvfrom(r1, &(0x7f0000000100)=""/174, 0xae, 0x0, &(0x7f00000001c0)=@pppoe={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2}, 'bridge_slave_0\x00'}}, 0x709000) [ 146.105042] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20004 [ 146.123256] binder: release 9916:9924 transaction 39 out, still active [ 146.130066] binder: unexpected work type, 4, not freed [ 146.135391] binder: undelivered TRANSACTION_COMPLETE [ 146.149870] binder: invalid inc weak node for 40 10:06:57 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='htcp\x00', 0x0) 10:06:57 executing program 1: syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f0000000100)="2e2f66696c65302f662e2e2e30f0ff00", 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000240)={[{@codepage={'codepage', 0x3d, '852'}, 0x2c}]}) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) creat(&(0x7f00000003c0)="2e2f66696c65302f2e2e2e2e30f0ff", 0xfffffffffffffffc) unlink(&(0x7f0000000380)="2e2f66696c65302f2e2e2e2e30f0ff00") [ 146.154804] binder: 9916:9924 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 146.196525] *** Guest State *** [ 146.199978] CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7 [ 146.208960] CR4: actual=0x0000000000002040, shadow=0x0000000000000000, gh_mask=ffffffffffffe871 [ 146.213532] binder: send failed reply for transaction 39, target dead [ 146.217845] CR3 = 0x0000000000000000 [ 146.228202] RSP = 0x0000000000000000 RIP = 0x0000000000000000 [ 146.234208] RFLAGS=0x0001a202 DR7 = 0x0000000000000400 [ 146.240244] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 [ 146.246969] CS: sel=0xf000, attr=0x0009b, limit=0x0000ffff, base=0x00000000ffff0000 [ 146.255008] DS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 146.263053] SS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 146.271076] ES: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 146.279105] FS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 146.287126] GS: sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000 [ 146.295133] GDTR: limit=0x0000ffff, base=0x0000000000000000 [ 146.303160] LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000 [ 146.311164] IDTR: limit=0x0000ffff, base=0x0000000000000000 [ 146.319188] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 146.327190] EFER = 0x0000000000000000 PAT = 0x0007040600070406 [ 146.333646] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 146.341119] Interruptibility = 00000000 ActivityState = 00000000 [ 146.347405] *** Host State *** [ 146.350631] RIP = 0xffffffff811f741c RSP = 0xffff8801b1e47390 [ 146.356662] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 146.363099] FSBase=00007fafa93c8700 GSBase=ffff8801daf00000 TRBase=fffffe0000034000 [ 146.370933] GDTBase=fffffe0000032000 IDTBase=fffffe0000000000 [ 146.376851] CR0=0000000080050033 CR3=00000001b467d000 CR4=00000000001426e0 [ 146.383910] Sysenter RSP=fffffe0000033200 CS:RIP=0010:ffffffff87801380 [ 146.390604] EFER = 0x0000000000000d01 PAT = 0x0000000000000000 [ 146.396711] *** Control State *** [ 146.400274] PinBased=0000003f CPUBased=b5a06dfa SecondaryExec=000000c3 [ 146.406983] EntryControls=0000d1ff ExitControls=0023efff [ 146.412563] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 146.419536] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 146.426322] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 146.432945] reason=80000021 qualification=0000000000000000 [ 146.439310] IDTVectoring: info=00000000 errcode=00000000 [ 146.444811] TSC Offset = 0xffffffaf28b06285 [ 146.449160] TPR Threshold = 0x00 [ 146.452568] EPT pointer = 0x00000001c6c8f01e [ 146.512320] kvm [9920]: vcpu0, guest rIP: 0x0 kvm_set_msr_common: MSR_IA32_DEBUGCTLMSR 0x1, nop [ 146.536359] kvm [9920]: vcpu0, guest rIP: 0xfff0 kvm_set_msr_common: MSR_IA32_DEBUGCTLMSR 0x1, nop 10:06:58 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x7005, &(0x7f0000000040)) 10:06:58 executing program 4: r0 = fanotify_init(0x0, 0x0) fanotify_mark(r0, 0xd, 0x48000000, 0xffffffffffffffff, &(0x7f0000000140)='/\x00') r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)="2f007e574d000330809022cfde26555dc9ecfe1974406edad38364782d63b6612854b9e49dbdcaef718197e37e870a308b1e3a798fa788a46d3025ef933e51828ab675064e2adbe9126423b4a73d68fbe99c6db2f160d49cb6cce76c27289a4f9d097354aaa5860d2383df87526baa184d90bb7729366c17bc33d765e9bc2f882a13f3a9c1f60660bd4fd2fa02d2c0a775242289bce062d10d24ded5406918a66b2c75c43fe1ff458ae5cd9fec63039ba5a7b66a60ede5ccdabc7ee77660ef2358ccdff02226021384b0c235f114ed9ade92767aecc256acdeb610df42e7169f240357f735ae5fe29017e51e27252f48b95bfbbb3a865535298bdc36d71db635f41c57771db77aeaff883feb3dc3cc24bd3c036e396ad3af37945058839e812270bc40901fa654e7cc3292a82fc80c374dc07142a1c2e9d3e2528e4fdac32bcaefe910ebd3b948a3bfebef5fa8d82473c7fbf3ec4b5bdc84a7f5dc3a10098dc652dc731f1fa90b0afe5f8dc296fc240076fda98c25b9855d02f8a5c6fc7ca1faa3fe7c41ebc018d5b154e73fdea0105498520673b7aced7cfc9f1b67208da5db9b96ba74bb669a0ec9f2f4fee4f177b501", 0x0, 0x0) fchmod(r1, 0x0) 10:06:58 executing program 6: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@getsadinfo={0x14, 0x23, 0x707}, 0x14}, 0x1}, 0x0) 10:06:58 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x14, 0x1d, 0xfffffffffffffffd, 0x0, 0x0, {0x1f}}, 0x14}, 0x1}, 0x0) recvfrom(r1, &(0x7f0000000100)=""/174, 0xae, 0x0, &(0x7f00000001c0)=@pppoe={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2}, 'bridge_slave_0\x00'}}, 0x709000) 10:06:58 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x43) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b20000)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x3}]}, 0x10) sendmmsg(r1, &(0x7f000070b000)=[{{0x0, 0x0, &(0x7f00007ed000)=[{&(0x7f0000d90fa7)='u', 0x1}], 0x1, &(0x7f0000275000)}}], 0x1, 0x48084) shutdown(r1, 0x1) 10:06:58 executing program 1: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x2, 0x0) write$binfmt_elf32(r0, &(0x7f00000005c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x20}, [{}]}, 0x58) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x1013, r0, 0x0) ioctl$int_in(r0, 0x80000000005001, &(0x7f00000004c0)) 10:06:58 executing program 7: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(0xffffffffffffffff, r1) 10:06:58 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x25}, [], {0x95}}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) 10:06:59 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/protocols\x00') sendfile(r0, r1, &(0x7f0000000040)=0x100000, 0x101) 10:06:59 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket(0x11, 0x2, 0x0) bind$packet(r1, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x8}]}, 0x10) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14}}, 0x10) sendto$inet(r2, &(0x7f0000000040), 0x34000, 0x20000800, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) 10:06:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}, [], {0x95}}, &(0x7f0000014ff5)="73797a6b610000000500f3", 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f000001b000)={r1, 0x0, 0x36, 0x9d, &(0x7f0000013000)="e460019234060dc106621abc86dd6a000000000733eb305660319056115082553800800000000000e8d5000000010000001400000000", &(0x7f000001df63)=""/157, 0x28}, 0x28) 10:06:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x14, 0x1d, 0xfffffffffffffffd, 0x0, 0x0, {0x1f}}, 0x14}, 0x1}, 0x0) recvfrom(r1, &(0x7f0000000100)=""/174, 0xae, 0x0, &(0x7f00000001c0)=@pppoe={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2}, 'bridge_slave_0\x00'}}, 0x709000) 10:06:59 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10, 0x4, 0x4, 0x80000001}, 0x2c) 10:06:59 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x43) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b20000)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x3}]}, 0x10) sendmmsg(r1, &(0x7f000070b000)=[{{0x0, 0x0, &(0x7f00007ed000)=[{&(0x7f0000d90fa7)='u', 0x1}], 0x1, &(0x7f0000275000)}}], 0x1, 0x48084) shutdown(r1, 0x1) 10:06:59 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970") perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 10:07:00 executing program 5: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000380)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000056ff8)='./>ile0\x00', 0x0) getpid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, @tid=0xffffffffffffffff}, &(0x7f00000000c0)) 10:07:00 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x14, 0x1d, 0xfffffffffffffffd, 0x0, 0x0, {0x1f}}, 0x14}, 0x1}, 0x0) recvfrom(r1, &(0x7f0000000100)=""/174, 0xae, 0x0, &(0x7f00000001c0)=@pppoe={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2}, 'bridge_slave_0\x00'}}, 0x709000) 10:07:00 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000380)=0x8000000a, 0x4) bind$inet(r0, &(0x7f00001edff0)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000000)=0x8, 0x4) recvmsg(r0, &(0x7f0000000300)={&(0x7f0000000140)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @dev}}}, 0x80}, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000c95ffd), 0x0, 0x0, &(0x7f000057bff0)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) 10:07:00 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(camellia-generic)\x00'}, 0x58) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="b7f2280a911993fc497ddd543a0700000000000000d38df0", 0x18) r2 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmsg(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000002c0)=""/4096, 0x200009c0}], 0x1, &(0x7f0000001400)=""/123, 0x7b}, 0x0) 10:07:00 executing program 2: r0 = socket(0x10, 0x3, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f00000002c0)={'ip6_vti0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) 10:07:00 executing program 0: r0 = socket(0x2, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000069c000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0x40085112, &(0x7f0000b18000)={{0xffffff92}, {0xffffffb0}}) 10:07:00 executing program 7: getpid() pipe2(&(0x7f0000989000)={0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='trusted.syz\x00', &(0x7f0000000300)='jfs\x00', 0x4, 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000abf000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) dup2(r0, r1) 10:07:00 executing program 1: r0 = add_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a}, &(0x7f0000000400)='V', 0x1, 0xffffffffffffffff) keyctl$setperm(0x5, r0, 0x103) r1 = socket(0x40000000015, 0x5, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(0x0, r2) keyctl$setperm(0x11, r0, 0x0) 10:07:00 executing program 3: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000100)) ioctl$TIOCLINUX6(0xffffffffffffffff, 0x541c, &(0x7f00000000c0)={0x6, 0xffffffffffffffc1}) r0 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$fiemap(r0, 0x40086602, &(0x7f00000000c0)=ANY=[]) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$fiemap(r1, 0x40086602, &(0x7f0000000140)=ANY=[]) 10:07:00 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xfffffffe) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x40087708, &(0x7f00000011c0)="000000800000800000") close(r1) 10:07:00 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") msgsnd(0x0, &(0x7f0000001640)=ANY=[@ANYRES16], 0x1, 0x0) msgrcv(0x0, &(0x7f0000981000), 0x102, 0x0, 0x0) 10:07:00 executing program 2: r0 = socket(0x10, 0x3, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f00000002c0)={'ip6_vti0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) 10:07:00 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000400)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f00000003c0)=ANY=[]) open(&(0x7f0000000640)="2e2f66696c65302f662e6c6530f0", 0x40003ffe, 0x0) truncate(&(0x7f00000000c0)="2e2f66696c65302f662e6c6530f000", 0x8) unlink(&(0x7f0000000000)="2e2f66696c65302f662e6c6530f000") 10:07:00 executing program 1: r0 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f00000003c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a}, 0x0, 0x0, r1) r3 = add_key$user(&(0x7f00003bd000)='user\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a}, &(0x7f0000000440)='\x00', 0x1, r2) r4 = add_key$user(&(0x7f0000fc0ffb)='user\x00', &(0x7f0000752ffb)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00003eb000)="b3", 0x1, r2) keyctl$update(0x2, r4, &(0x7f0000000480)="df02754677212dfc3e2acc26fdc3ffa64813da494137e175e9f2780ac5e2a09f43a1fcebf272a5a135de92bf4a9033933824f6e6aa023895113293535d1c0066d20e0f275188b4b4c187e18774fc2227cbb60fc6697f5337726164c8fbe1181e6d50986cd98a5c44ac0ec375deb27eafcf7d06438f252510d87bd91d03e7dc2faed85adcd88ca30e75b1e143a72d94defa187e48b89efbbbcc9b9a9a307353df7a21affce4e9149eb122cbc356cb681365afd979e97b57b596e901864a68679f", 0xc0) keyctl$dh_compute(0x17, &(0x7f0000000100)={r3, r4, r3}, &(0x7f0000a53ffb)=""/5, 0x5, &(0x7f0000c61fc8)={&(0x7f0000a3dffa)={'sha224-avx\x00'}}) [ 148.883796] ================================================================== [ 148.892007] BUG: KASAN: slab-out-of-bounds in sha256_finup+0x4bf/0x540 [ 148.898665] Write of size 4 at addr ffff8801d8d3a8e0 by task syz-executor1/10072 [ 148.906175] [ 148.907793] CPU: 0 PID: 10072 Comm: syz-executor1 Not tainted 4.17.0+ #88 [ 148.914741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 148.924076] Call Trace: [ 148.926657] dump_stack+0x1b9/0x294 [ 148.930278] ? dump_stack_print_info.cold.2+0x52/0x52 [ 148.935460] ? printk+0x9e/0xba [ 148.938748] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 148.943501] ? kasan_check_write+0x14/0x20 [ 148.947734] print_address_description+0x6c/0x20b [ 148.952558] ? sha256_finup+0x4bf/0x540 [ 148.956514] kasan_report.cold.7+0x242/0x2fe [ 148.960907] __asan_report_store4_noabort+0x17/0x20 [ 148.965905] sha256_finup+0x4bf/0x540 [ 148.969685] ? done_hash+0xe/0xe [ 148.973042] sha256_avx_final+0x28/0x30 [ 148.977017] crypto_shash_final+0x104/0x260 [ 148.981325] ? sha256_avx_finup+0x40/0x40 [ 148.985466] __keyctl_dh_compute+0x1184/0x1bc0 [ 148.990044] ? copy_overflow+0x30/0x30 [ 148.993917] ? save_stack+0xa9/0xd0 [ 148.997537] ? find_held_lock+0x36/0x1c0 [ 149.001585] ? lock_downgrade+0x8e0/0x8e0 [ 149.005718] ? check_same_owner+0x320/0x320 [ 149.010035] ? schedule+0xef/0x430 [ 149.013567] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 149.019102] ? _copy_from_user+0xdf/0x150 [ 149.023241] keyctl_dh_compute+0xb9/0x100 [ 149.027372] ? __keyctl_dh_compute+0x1bc0/0x1bc0 [ 149.032120] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 149.036955] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 149.042129] __x64_sys_keyctl+0x12a/0x3b0 [ 149.046261] do_syscall_64+0x1b1/0x800 [ 149.050127] ? finish_task_switch+0x1ca/0x840 [ 149.054605] ? syscall_return_slowpath+0x5c0/0x5c0 [ 149.059525] ? syscall_return_slowpath+0x30f/0x5c0 [ 149.064451] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 149.069796] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 149.074621] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 149.079786] RIP: 0033:0x455a09 [ 149.082953] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 149.102170] RSP: 002b:00007f2239880c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 149.109860] RAX: ffffffffffffffda RBX: 00007f22398816d4 RCX: 0000000000455a09 [ 149.117131] RDX: 0000000020a53ffb RSI: 0000000020000100 RDI: 0000000000000017 [ 149.124388] RBP: 000000000072bea0 R08: 0000000020c61fc8 R09: 0000000000000000 [ 149.131641] R10: 0000000000000005 R11: 0000000000000246 R12: 00000000ffffffff [ 149.138892] R13: 0000000000000499 R14: 00000000006fbef8 R15: 0000000000000000 [ 149.146144] [ 149.147749] Allocated by task 10072: [ 149.151454] save_stack+0x43/0xd0 [ 149.154900] kasan_kmalloc+0xc4/0xe0 [ 149.158601] __kmalloc+0x14e/0x760 [ 149.162121] __keyctl_dh_compute+0xfe9/0x1bc0 [ 149.166594] keyctl_dh_compute+0xb9/0x100 [ 149.170718] __x64_sys_keyctl+0x12a/0x3b0 [ 149.174846] do_syscall_64+0x1b1/0x800 [ 149.178711] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 149.183870] [ 149.185476] Freed by task 2840: [ 149.188738] save_stack+0x43/0xd0 [ 149.192182] __kasan_slab_free+0x11a/0x170 [ 149.196403] kasan_slab_free+0xe/0x10 [ 149.200191] kfree+0xd9/0x260 [ 149.203287] single_release+0x8f/0xb0 [ 149.207064] __fput+0x353/0x890 [ 149.210322] ____fput+0x15/0x20 [ 149.213589] task_work_run+0x1e4/0x290 [ 149.217456] exit_to_usermode_loop+0x2bd/0x310 [ 149.222033] do_syscall_64+0x6ac/0x800 [ 149.225905] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 149.231072] [ 149.232689] The buggy address belongs to the object at ffff8801d8d3a8c0 [ 149.232689] which belongs to the cache kmalloc-32 of size 32 [ 149.245159] The buggy address is located 0 bytes to the right of [ 149.245159] 32-byte region [ffff8801d8d3a8c0, ffff8801d8d3a8e0) [ 149.257266] The buggy address belongs to the page: [ 149.262172] page:ffffea0007634e80 count:1 mapcount:0 mapping:ffff8801d8d3a000 index:0xffff8801d8d3afc1 [ 149.271592] flags: 0x2fffc0000000100(slab) [ 149.275809] raw: 02fffc0000000100 ffff8801d8d3a000 ffff8801d8d3afc1 000000010000003f [ 149.283671] raw: ffffea0007627ea0 ffffea000764aae0 ffff8801da8001c0 0000000000000000 [ 149.291524] page dumped because: kasan: bad access detected [ 149.297206] [ 149.298807] Memory state around the buggy address: [ 149.303711] ffff8801d8d3a780: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 149.311050] ffff8801d8d3a800: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 149.318384] >ffff8801d8d3a880: 04 fc fc fc fc fc fc fc 00 00 00 00 fc fc fc fc [ 149.325719] ^ [ 149.332186] ffff8801d8d3a900: fb fb fb fb fc fc fc fc 05 fc fc fc fc fc fc fc [ 149.339523] ffff8801d8d3a980: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 149.346856] ================================================================== [ 149.354191] Disabling lock debugging due to kernel taint [ 149.359890] Kernel panic - not syncing: panic_on_warn set ... [ 149.359890] [ 149.367260] CPU: 0 PID: 10072 Comm: syz-executor1 Tainted: G B 4.17.0+ #88 [ 149.375574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 149.384917] Call Trace: [ 149.387488] dump_stack+0x1b9/0x294 [ 149.391094] ? dump_stack_print_info.cold.2+0x52/0x52 [ 149.396265] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 149.400999] ? sha256_finup+0x480/0x540 [ 149.404955] panic+0x22f/0x4de [ 149.408129] ? add_taint.cold.5+0x16/0x16 [ 149.412259] ? do_raw_spin_unlock+0x9e/0x2e0 [ 149.416644] ? do_raw_spin_unlock+0x9e/0x2e0 [ 149.421039] ? sha256_finup+0x4bf/0x540 [ 149.424995] kasan_end_report+0x47/0x4f [ 149.428952] kasan_report.cold.7+0x76/0x2fe [ 149.433261] __asan_report_store4_noabort+0x17/0x20 [ 149.438281] sha256_finup+0x4bf/0x540 [ 149.442071] ? done_hash+0xe/0xe [ 149.445417] sha256_avx_final+0x28/0x30 [ 149.449381] crypto_shash_final+0x104/0x260 [ 149.453689] ? sha256_avx_finup+0x40/0x40 [ 149.457819] __keyctl_dh_compute+0x1184/0x1bc0 [ 149.462394] ? copy_overflow+0x30/0x30 [ 149.466266] ? save_stack+0xa9/0xd0 [ 149.469875] ? find_held_lock+0x36/0x1c0 [ 149.473916] ? lock_downgrade+0x8e0/0x8e0 [ 149.478048] ? check_same_owner+0x320/0x320 [ 149.482352] ? schedule+0xef/0x430 [ 149.485887] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 149.491423] ? _copy_from_user+0xdf/0x150 [ 149.495568] keyctl_dh_compute+0xb9/0x100 [ 149.499712] ? __keyctl_dh_compute+0x1bc0/0x1bc0 [ 149.504453] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 149.509281] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 149.514460] __x64_sys_keyctl+0x12a/0x3b0 [ 149.518608] do_syscall_64+0x1b1/0x800 [ 149.522490] ? finish_task_switch+0x1ca/0x840 [ 149.526977] ? syscall_return_slowpath+0x5c0/0x5c0 [ 149.531883] ? syscall_return_slowpath+0x30f/0x5c0 [ 149.536792] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 149.542134] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 149.546956] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 149.552121] RIP: 0033:0x455a09 [ 149.555284] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 149.574398] RSP: 002b:00007f2239880c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 149.582084] RAX: ffffffffffffffda RBX: 00007f22398816d4 RCX: 0000000000455a09 [ 149.589333] RDX: 0000000020a53ffb RSI: 0000000020000100 RDI: 0000000000000017 [ 149.596598] RBP: 000000000072bea0 R08: 0000000020c61fc8 R09: 0000000000000000 [ 149.603854] R10: 0000000000000005 R11: 0000000000000246 R12: 00000000ffffffff [ 149.611103] R13: 0000000000000499 R14: 00000000006fbef8 R15: 0000000000000000 [ 149.618813] Dumping ftrace buffer: [ 149.622332] (ftrace buffer empty) [ 149.626015] Kernel Offset: disabled [ 149.629618] Rebooting in 86400 seconds..