ridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r3, 0x227d, &(0x7f0000000000)) 10:01:48 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000080)) 10:01:48 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x400040) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) 10:01:48 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8000) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8000) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) (async) 10:01:49 executing program 3: ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:49 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x400040) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async) syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x400040) (async) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) (async) 10:01:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) r2 = syz_open_dev$sg(&(0x7f0000000100), 0xffffffffffff7b46, 0x200) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000140)) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000000c0)) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x121800) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8000) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) (rerun: 32) 10:01:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) r2 = syz_open_dev$sg(&(0x7f0000000100), 0xffffffffffff7b46, 0x200) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000140)) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000000c0)) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x121800) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:49 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x400040) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async) syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x400040) (async) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) (async) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xe689, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f00000000c0)=0x6) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000440)) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='wg2\x00', 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f0000000400)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000044) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_NUM_WAITING(r3, 0x2201, &(0x7f0000000000)) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:49 executing program 3: ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4, 0x121800) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:49 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) r4 = syz_io_uring_setup(0x4fd8, &(0x7f0000000400)={0x0, 0x2feb, 0x10, 0x2, 0x3a2, 0x0, r1}, &(0x7f0000ff2000/0xb000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000480)) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0x48c6, 0x1, 0x0, 0xd7, 0x0, r4}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 4: syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/net\x00') r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x2, 0x200001) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f00000000c0)) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x1, 'ipvlan1\x00', {}, 0xfff8}) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000100)=0x40) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xe689, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f00000000c0)=0x6) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000440)) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='wg2\x00', 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f0000000400)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000044) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$SG_GET_NUM_WAITING(r3, 0x2201, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0xe689, 0x0) (async) socket$pptp(0x18, 0x1, 0x2) (async) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f00000000c0)=0x6) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000440)) (async) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='wg2\x00', 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f0000000400)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000044) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async) ioctl$SG_GET_NUM_WAITING(r3, 0x2201, &(0x7f0000000000)) (async) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff8, 0x2) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509c79142c4bf722011000000080041007300330076657468315f746f5f627269646765000900020073797a310000000008b72800727865001400330076657468305f746f5f7465616d00fe5ecc5ceaeae47a873eec000009000200737900140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e3000000000000000000026d3f6ce74c7fdad4cc763f12d680900020073797a3200000000080041007369770014003300000000000000002f000000000008004100727865001400330076657468315f766900000000000000000000000000a8677d63e4232c32e775d4c430e1e08a6077bf597776836508b1f58353564469e5ff92168d6f216eac03382698466bec609272fd4a6ddea2972b8ba96d47dc6475b02ba933f2c2beed13a75b8a9dbf664d90884e6df92623e98c6277c9991ff50400000000000000a3bf4e9fd05479eaf0c141a7438bb6f044557ee963d0d689bed9e7a37a17cd1985eff04dfad4759e8abf3396d3a43ac766e352b0b0b6b3b8820e1894e3a20000"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000040), 0x10) 10:01:49 executing program 4: syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/net\x00') r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x2, 0x200001) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f00000000c0)) (async) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x1, 'ipvlan1\x00', {}, 0xfff8}) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000100)=0x40) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xe689, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f00000000c0)=0x6) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000440)) (async, rerun: 64) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='wg2\x00', 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f0000000400)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000044) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 64) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) (async, rerun: 64) ioctl$SG_GET_NUM_WAITING(r3, 0x2201, &(0x7f0000000000)) 10:01:49 executing program 4: syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/net\x00') r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x2, 0x200001) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f00000000c0)) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x1, 'ipvlan1\x00', {}, 0xfff8}) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000100)=0x40) syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/net\x00') (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x2, 0x200001) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f00000000c0)) (async) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x1, 'ipvlan1\x00', {}, 0xfff8}) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000100)=0x40) (async) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff8, 0x2) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509c79142c4bf722011000000080041007300330076657468315f746f5f627269646765000900020073797a310000000008b72800727865001400330076657468305f746f5f7465616d00fe5ecc5ceaeae47a873eec000009000200737900140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e3000000000000000000026d3f6ce74c7fdad4cc763f12d680900020073797a3200000000080041007369770014003300000000000000002f000000000008004100727865001400330076657468315f766900000000000000000000000000a8677d63e4232c32e775d4c430e1e08a6077bf597776836508b1f58353564469e5ff92168d6f216eac03382698466bec609272fd4a6ddea2972b8ba96d47dc6475b02ba933f2c2beed13a75b8a9dbf664d90884e6df92623e98c6277c9991ff50400000000000000a3bf4e9fd05479eaf0c141a7438bb6f044557ee963d0d689bed9e7a37a17cd1985eff04dfad4759e8abf3396d3a43ac766e352b0b0b6b3b8820e1894e3a20000"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff8, 0x2) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509c79142c4bf722011000000080041007300330076657468315f746f5f627269646765000900020073797a310000000008b72800727865001400330076657468305f746f5f7465616d00fe5ecc5ceaeae47a873eec000009000200737900140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e3000000000000000000026d3f6ce74c7fdad4cc763f12d680900020073797a3200000000080041007369770014003300000000000000002f000000000008004100727865001400330076657468315f766900000000000000000000000000a8677d63e4232c32e775d4c430e1e08a6077bf597776836508b1f58353564469e5ff92168d6f216eac03382698466bec609272fd4a6ddea2972b8ba96d47dc6475b02ba933f2c2beed13a75b8a9dbf664d90884e6df92623e98c6277c9991ff50400000000000000a3bf4e9fd05479eaf0c141a7438bb6f044557ee963d0d689bed9e7a37a17cd1985eff04dfad4759e8abf3396d3a43ac766e352b0b0b6b3b8820e1894e3a20000"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) (async) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) (async) 10:01:49 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) (async) r4 = syz_io_uring_setup(0x4fd8, &(0x7f0000000400)={0x0, 0x2feb, 0x10, 0x2, 0x3a2, 0x0, r1}, &(0x7f0000ff2000/0xb000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000480)) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0x48c6, 0x1, 0x0, 0xd7, 0x0, r4}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r3, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 3: syz_io_uring_setup(0x203d, &(0x7f00000000c0)={0x0, 0x3d72, 0x10, 0x1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000040), &(0x7f0000000140)) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000040), 0x10) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0x7b) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff8, 0x2) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509c79142c4bf722011000000080041007300330076657468315f746f5f627269646765000900020073797a310000000008b72800727865001400330076657468305f746f5f7465616d00fe5ecc5ceaeae47a873eec000009000200737900140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e3000000000000000000026d3f6ce74c7fdad4cc763f12d680900020073797a3200000000080041007369770014003300000000000000002f000000000008004100727865001400330076657468315f766900000000000000000000000000a8677d63e4232c32e775d4c430e1e08a6077bf597776836508b1f58353564469e5ff92168d6f216eac03382698466bec609272fd4a6ddea2972b8ba96d47dc6475b02ba933f2c2beed13a75b8a9dbf664d90884e6df92623e98c6277c9991ff50400000000000000a3bf4e9fd05479eaf0c141a7438bb6f044557ee963d0d689bed9e7a37a17cd1985eff04dfad4759e8abf3396d3a43ac766e352b0b0b6b3b8820e1894e3a20000"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 32) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) (async, rerun: 32) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) 10:01:49 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) 10:01:49 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) (async) r4 = syz_io_uring_setup(0x4fd8, &(0x7f0000000400)={0x0, 0x2feb, 0x10, 0x2, 0x3a2, 0x0, r1}, &(0x7f0000ff2000/0xb000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000480)) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0x48c6, 0x1, 0x0, 0xd7, 0x0, r4}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0x7b) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000040), 0x10) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000040), 0x10) (async) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) 10:01:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x283) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0x7b) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) 10:01:49 executing program 3: syz_io_uring_setup(0x203d, &(0x7f00000000c0)={0x0, 0x3d72, 0x10, 0x1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000040), &(0x7f0000000140)) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) syz_io_uring_setup(0x203d, &(0x7f00000000c0)={0x0, 0x3d72, 0x10, 0x1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000040), &(0x7f0000000140)) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) 10:01:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x283) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xb94, 0x1) 10:01:49 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) socket$pptp(0x18, 0x1, 0x2) (async) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) (async) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) (async) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) (async) 10:01:49 executing program 1: ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000080)) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004814}, 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)=0x1) 10:01:49 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0xb94, 0x1) 10:01:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x283) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) socket$pptp(0x18, 0x1, 0x2) (async) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) (async) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) (async) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) (async) 10:01:49 executing program 1: ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000080)) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004814}, 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000080)) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004814}, 0x8) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) 10:01:49 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xb94, 0x1) 10:01:49 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000540)=0xfffffffd) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) syz_io_uring_setup(0x42fc, &(0x7f0000000400)={0x0, 0x9c35, 0x2, 0x0, 0x10a, 0x0, r2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa, 0x12, r4, 0x0) syz_io_uring_submit(r6, r5, &(0x7f0000000500)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f00000004c0)=@IORING_OP_POLL_REMOVE={0x7, 0x3, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0xfff) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a31000000ec344c5e00736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f776966692fca0295ac082c3ebc26de252c64a3130b8e6e528ff95ea21971ce582b8a6b177dc9a4bfdbac294cb7fe883f2750a53808b8d7c1637c08fcc733bf7828300da4b654a487e6141b22cbec92743c967315fd5be4ce7dbff8909e2b1239d424f4610b4f83957fee758243acb49941fdbe0828ad1f57503e183910d27a45caac6919c2abfd6f046a9bf34706c5fa1756e1303bef8d4f0e9bd639e8fcd6bcaefdf868e7921e20e7c6f2486113fd015eeb5b802172475d832d4a0c41658d30ab93442604955d3c5275fd9d4bc506a422972b454ed6d453c07a39bfac27642f5304eb14bdcba58000"/538], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) accept4$llc(r1, 0x0, &(0x7f0000000080), 0x80000) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 3: syz_io_uring_setup(0x203d, &(0x7f00000000c0)={0x0, 0x3d72, 0x10, 0x1}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000040), &(0x7f0000000140)) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:49 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000004c0)={'ip6_vti0\x00', &(0x7f0000000440)={'syztnl1\x00', 0x0, 0x4, 0x5, 0xed, 0x8, 0x20, @mcast1, @private1, 0x20, 0x8000, 0x4, 0x8}}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000080)={0x2, 0x4e24, @empty}, 0x10, &(0x7f00000003c0)=[{&(0x7f00000000c0)="7010a2973c05091871bf785d7c099912a3b3767fa7918ffff0036f9908a6495dab266a6f01e1854c92f3e613005d09e8049a8ac48cc914343bf33d3baa5deed5e898d1977e3b72812ea9bea1b72c5333af17097825ac893a5cd5b2ceec3f7de404d8e5a1e032ce0e955af9a50709fd6e52c4e05bd2cdbb9c1d1eeea7eb5b5566626f2cb2e87e2fb96af94f32", 0x8c}, {&(0x7f0000000180)="81e94cbde9bd3b16ba8aaa4e7baecef59995ddc390287ec4", 0x18}, {&(0x7f00000001c0)="2a5e5b2eb143b978f6ca38ef5b7e7aade0233b5be562c2782351b31e6a776bae00eaf5caca453c0dfeba66f067c13cf9328913e1345b3cb35a7e9710d1570c6e3fba87ee5821d272d2a1d5a96c4bf7f18cad2d7572c1fb3fbd7a21c911f73ade841626e4ff6fa9602b9e23b5468a60eaddc34435739517d66d1b3f43ff3910112f3562051a32f64490734e3237cb5f62845d1f7d3dafb8ecad7d50936263582f4d99b7cf6417d26f0ecc884e9d308d716d6a96a0428d77c3d922d221ea186c5a1250fe545f0694f73f98bf31a00284e4e7ba2f8310154d39f10892263e03dab6420a65af2aeda578b2208bb8cf249a3e7c579682b316371a2b07f2da6d", 0xfd}, {&(0x7f00000002c0)="8b2640185675c160386677183afe9c753829bfabf69f130751483e4f55fe", 0x1e}, {&(0x7f0000000300)="51485e865136ca5d622c9de55eaa278efc36157fee958d0897b9342e6fed7d6749cac5a275045f0ad6405fe591aa778124e8bbd6b803b9d2f132c3538de928517917b4f0764fb0a8ca6eea69e0902b41d1bb0b81122104182027b89261af9221159e8d9ddf7c4a341e478acf95f9e72459dc6651394953c08a01f111645e84448c933fdf1742fe7cd3a85087fd88a178f03c765bd42774074ad292660ef005cee9732f", 0xa3}], 0x5, &(0x7f0000000500)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_retopts={{0x40, 0x0, 0x7, {[@noop, @timestamp={0x44, 0x10, 0xa9, 0x0, 0x7, [0x200, 0xe9ee, 0x7]}, @rr={0x7, 0x1b, 0x41, [@broadcast, @multicast2, @multicast1, @remote, @local, @empty]}, @noop]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @private=0xa010101}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @multicast1}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x23a}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @rand_addr=0x64010101, @empty}}}], 0xe8}, 0x41) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000006c0)={'ip6gre0\x00', &(0x7f0000000640)={'ip6_vti0\x00', r1, 0x29, 0x5, 0x7b, 0x8, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @private2, 0x10, 0x7, 0x1, 0x3}}) ioctl$SG_GET_NUM_WAITING(r4, 0x2270, &(0x7f0000000000)) 10:01:49 executing program 1: ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000080)) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x0, 0x100, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x7}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004814}, 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:49 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) 10:01:49 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000540)=0xfffffffd) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) syz_io_uring_setup(0x42fc, &(0x7f0000000400)={0x0, 0x9c35, 0x2, 0x0, 0x10a, 0x0, r2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa, 0x12, r4, 0x0) syz_io_uring_submit(r6, r5, &(0x7f0000000500)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f00000004c0)=@IORING_OP_POLL_REMOVE={0x7, 0x3, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0xfff) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a31000000ec344c5e00736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f776966692fca0295ac082c3ebc26de252c64a3130b8e6e528ff95ea21971ce582b8a6b177dc9a4bfdbac294cb7fe883f2750a53808b8d7c1637c08fcc733bf7828300da4b654a487e6141b22cbec92743c967315fd5be4ce7dbff8909e2b1239d424f4610b4f83957fee758243acb49941fdbe0828ad1f57503e183910d27a45caac6919c2abfd6f046a9bf34706c5fa1756e1303bef8d4f0e9bd639e8fcd6bcaefdf868e7921e20e7c6f2486113fd015eeb5b802172475d832d4a0c41658d30ab93442604955d3c5275fd9d4bc506a422972b454ed6d453c07a39bfac27642f5304eb14bdcba58000"/538], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) accept4$llc(r1, 0x0, &(0x7f0000000080), 0x80000) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000540)=0xfffffffd) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) syz_io_uring_setup(0x42fc, &(0x7f0000000400)={0x0, 0x9c35, 0x2, 0x0, 0x10a, 0x0, r2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000000c0), &(0x7f0000000480)) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa, 0x12, r4, 0x0) (async) syz_io_uring_submit(r6, r5, &(0x7f0000000500)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) (async) syz_io_uring_submit(r3, r5, &(0x7f00000004c0)=@IORING_OP_POLL_REMOVE={0x7, 0x3, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0xfff) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a31000000ec344c5e00736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f776966692fca0295ac082c3ebc26de252c64a3130b8e6e528ff95ea21971ce582b8a6b177dc9a4bfdbac294cb7fe883f2750a53808b8d7c1637c08fcc733bf7828300da4b654a487e6141b22cbec92743c967315fd5be4ce7dbff8909e2b1239d424f4610b4f83957fee758243acb49941fdbe0828ad1f57503e183910d27a45caac6919c2abfd6f046a9bf34706c5fa1756e1303bef8d4f0e9bd639e8fcd6bcaefdf868e7921e20e7c6f2486113fd015eeb5b802172475d832d4a0c41658d30ab93442604955d3c5275fd9d4bc506a422972b454ed6d453c07a39bfac27642f5304eb14bdcba58000"/538], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) accept4$llc(r1, 0x0, &(0x7f0000000080), 0x80000) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) (async) 10:01:49 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = syz_io_uring_complete(0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0xdf, 0x3, 0x1, "a85a0ac3046554930f58f43bb4d23916c59c7ed14eab23bcd19ec25c353f260c3bf045c03274736d20167d97eaa3565fb041eafecb09bc1be3650bce67e257edea12187882266f4dad4e7dce21b6015080c5132b52214e9d69155553c1433fad3bb41bbb722ee4584156603984eb96e9c8950abd7b021ee76a998a3709e356e0a042e5c456c4402ae3a5c1cc4fa6a4fb1d894f7ffa0863609300f3df01993e7162a61f5d62289bba3acb86af74d8f69e6f931637386af202977ebd050657ab7de27f93b198f968634e7165306ceb75483b8bbee62e90cfaf9343f1d98c1df6"}) 10:01:49 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000004c0)={'ip6_vti0\x00', &(0x7f0000000440)={'syztnl1\x00', 0x0, 0x4, 0x5, 0xed, 0x8, 0x20, @mcast1, @private1, 0x20, 0x8000, 0x4, 0x8}}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) (async) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000080)={0x2, 0x4e24, @empty}, 0x10, &(0x7f00000003c0)=[{&(0x7f00000000c0)="7010a2973c05091871bf785d7c099912a3b3767fa7918ffff0036f9908a6495dab266a6f01e1854c92f3e613005d09e8049a8ac48cc914343bf33d3baa5deed5e898d1977e3b72812ea9bea1b72c5333af17097825ac893a5cd5b2ceec3f7de404d8e5a1e032ce0e955af9a50709fd6e52c4e05bd2cdbb9c1d1eeea7eb5b5566626f2cb2e87e2fb96af94f32", 0x8c}, {&(0x7f0000000180)="81e94cbde9bd3b16ba8aaa4e7baecef59995ddc390287ec4", 0x18}, {&(0x7f00000001c0)="2a5e5b2eb143b978f6ca38ef5b7e7aade0233b5be562c2782351b31e6a776bae00eaf5caca453c0dfeba66f067c13cf9328913e1345b3cb35a7e9710d1570c6e3fba87ee5821d272d2a1d5a96c4bf7f18cad2d7572c1fb3fbd7a21c911f73ade841626e4ff6fa9602b9e23b5468a60eaddc34435739517d66d1b3f43ff3910112f3562051a32f64490734e3237cb5f62845d1f7d3dafb8ecad7d50936263582f4d99b7cf6417d26f0ecc884e9d308d716d6a96a0428d77c3d922d221ea186c5a1250fe545f0694f73f98bf31a00284e4e7ba2f8310154d39f10892263e03dab6420a65af2aeda578b2208bb8cf249a3e7c579682b316371a2b07f2da6d", 0xfd}, {&(0x7f00000002c0)="8b2640185675c160386677183afe9c753829bfabf69f130751483e4f55fe", 0x1e}, {&(0x7f0000000300)="51485e865136ca5d622c9de55eaa278efc36157fee958d0897b9342e6fed7d6749cac5a275045f0ad6405fe591aa778124e8bbd6b803b9d2f132c3538de928517917b4f0764fb0a8ca6eea69e0902b41d1bb0b81122104182027b89261af9221159e8d9ddf7c4a341e478acf95f9e72459dc6651394953c08a01f111645e84448c933fdf1742fe7cd3a85087fd88a178f03c765bd42774074ad292660ef005cee9732f", 0xa3}], 0x5, &(0x7f0000000500)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_retopts={{0x40, 0x0, 0x7, {[@noop, @timestamp={0x44, 0x10, 0xa9, 0x0, 0x7, [0x200, 0xe9ee, 0x7]}, @rr={0x7, 0x1b, 0x41, [@broadcast, @multicast2, @multicast1, @remote, @local, @empty]}, @noop]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @private=0xa010101}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @multicast1}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x23a}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @rand_addr=0x64010101, @empty}}}], 0xe8}, 0x41) (async) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000006c0)={'ip6gre0\x00', &(0x7f0000000640)={'ip6_vti0\x00', r1, 0x29, 0x5, 0x7b, 0x8, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @private2, 0x10, 0x7, 0x1, 0x3}}) ioctl$SG_GET_NUM_WAITING(r4, 0x2270, &(0x7f0000000000)) 10:01:49 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_io_uring_complete(0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) 10:01:49 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000140)="8f6c4e7296bdafe3794c17ba20275b3a29be8ef6a98f3ccc1bc118afa02f3275ca0bee09f2b5d2d1a5d1194fabcbf5796033d57ca3602aa7557a3814c73db79b74e078c81fec9df6f8f7390be4d47ed3b6d665580339b78b87", &(0x7f00000001c0)=@udp=r0, 0x1}, 0x20) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000100)=0x1) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_complete(r2) syz_io_uring_setup(0x5b77, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031400022cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a3200f6ff000800410073697700140033006261746164765f736c6176655f3000000900020073797a786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r3, 0x5382, &(0x7f0000000240)) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r3, 0x89f4, &(0x7f0000000800)={'syztnl2\x00', &(0x7f0000000780)={'ip6gre0\x00', 0x0, 0x2f, 0x5, 0xbb, 0xfffffffe, 0x22, @empty, @local, 0x20, 0x20, 0x3b7, 0x7}}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000001500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000014c0)={&(0x7f0000000840)={0xc44, 0x0, 0x2, 0x70bd29, 0x25dfdbfb, {}, [{{0x8}, {0xb4, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x1dc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x43f9}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x50d}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x41}}}]}}, {{0x8}, {0x254, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xff}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x1000, 0x75, 0x0, 0x9}, {0x81, 0x9, 0x9f, 0x90}, {0x2, 0x6, 0x6, 0x7f0000}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}]}}, {{0x8}, {0x110, 0x2, 0x0, 0x1, [{0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x0, 0x4, 0x2, 0x3}, {0x5, 0x1f, 0x1, 0x10000}, {0x68, 0x6, 0x20, 0x100}, {0x401, 0x80, 0x3, 0xfff}, {0xc0c5, 0x6, 0x5, 0x5}, {0x9, 0x4, 0x20}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}]}}, {{0x8}, {0x130, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x6, 0x4, 0x0, 0x3}, {0x800, 0x80, 0x5, 0x2}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x40}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0x1ac, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xe}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4bb20cb0}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xfc, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffff9}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2e7f}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x114, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0xc44}, 0x1, 0x0, 0x0, 0x24000840}, 0x4000) 10:01:49 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000004c0)={'ip6_vti0\x00', &(0x7f0000000440)={'syztnl1\x00', 0x0, 0x4, 0x5, 0xed, 0x8, 0x20, @mcast1, @private1, 0x20, 0x8000, 0x4, 0x8}}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) (async, rerun: 32) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000080)={0x2, 0x4e24, @empty}, 0x10, &(0x7f00000003c0)=[{&(0x7f00000000c0)="7010a2973c05091871bf785d7c099912a3b3767fa7918ffff0036f9908a6495dab266a6f01e1854c92f3e613005d09e8049a8ac48cc914343bf33d3baa5deed5e898d1977e3b72812ea9bea1b72c5333af17097825ac893a5cd5b2ceec3f7de404d8e5a1e032ce0e955af9a50709fd6e52c4e05bd2cdbb9c1d1eeea7eb5b5566626f2cb2e87e2fb96af94f32", 0x8c}, {&(0x7f0000000180)="81e94cbde9bd3b16ba8aaa4e7baecef59995ddc390287ec4", 0x18}, {&(0x7f00000001c0)="2a5e5b2eb143b978f6ca38ef5b7e7aade0233b5be562c2782351b31e6a776bae00eaf5caca453c0dfeba66f067c13cf9328913e1345b3cb35a7e9710d1570c6e3fba87ee5821d272d2a1d5a96c4bf7f18cad2d7572c1fb3fbd7a21c911f73ade841626e4ff6fa9602b9e23b5468a60eaddc34435739517d66d1b3f43ff3910112f3562051a32f64490734e3237cb5f62845d1f7d3dafb8ecad7d50936263582f4d99b7cf6417d26f0ecc884e9d308d716d6a96a0428d77c3d922d221ea186c5a1250fe545f0694f73f98bf31a00284e4e7ba2f8310154d39f10892263e03dab6420a65af2aeda578b2208bb8cf249a3e7c579682b316371a2b07f2da6d", 0xfd}, {&(0x7f00000002c0)="8b2640185675c160386677183afe9c753829bfabf69f130751483e4f55fe", 0x1e}, {&(0x7f0000000300)="51485e865136ca5d622c9de55eaa278efc36157fee958d0897b9342e6fed7d6749cac5a275045f0ad6405fe591aa778124e8bbd6b803b9d2f132c3538de928517917b4f0764fb0a8ca6eea69e0902b41d1bb0b81122104182027b89261af9221159e8d9ddf7c4a341e478acf95f9e72459dc6651394953c08a01f111645e84448c933fdf1742fe7cd3a85087fd88a178f03c765bd42774074ad292660ef005cee9732f", 0xa3}], 0x5, &(0x7f0000000500)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_retopts={{0x40, 0x0, 0x7, {[@noop, @timestamp={0x44, 0x10, 0xa9, 0x0, 0x7, [0x200, 0xe9ee, 0x7]}, @rr={0x7, 0x1b, 0x41, [@broadcast, @multicast2, @multicast1, @remote, @local, @empty]}, @noop]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @private=0xa010101}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @multicast1}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x23a}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @rand_addr=0x64010101, @empty}}}], 0xe8}, 0x41) (rerun: 32) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000006c0)={'ip6gre0\x00', &(0x7f0000000640)={'ip6_vti0\x00', r1, 0x29, 0x5, 0x7b, 0x8, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @private2, 0x10, 0x7, 0x1, 0x3}}) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x2270, &(0x7f0000000000)) 10:01:49 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000540)=0xfffffffd) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) syz_io_uring_setup(0x42fc, &(0x7f0000000400)={0x0, 0x9c35, 0x2, 0x0, 0x10a, 0x0, r2}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xa, 0x12, r4, 0x0) syz_io_uring_submit(r6, r5, &(0x7f0000000500)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f00000004c0)=@IORING_OP_POLL_REMOVE={0x7, 0x3, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0xfff) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a31000000ec344c5e00736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f776966692fca0295ac082c3ebc26de252c64a3130b8e6e528ff95ea21971ce582b8a6b177dc9a4bfdbac294cb7fe883f2750a53808b8d7c1637c08fcc733bf7828300da4b654a487e6141b22cbec92743c967315fd5be4ce7dbff8909e2b1239d424f4610b4f83957fee758243acb49941fdbe0828ad1f57503e183910d27a45caac6919c2abfd6f046a9bf34706c5fa1756e1303bef8d4f0e9bd639e8fcd6bcaefdf868e7921e20e7c6f2486113fd015eeb5b802172475d832d4a0c41658d30ab93442604955d3c5275fd9d4bc506a422972b454ed6d453c07a39bfac27642f5304eb14bdcba58000"/538], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) accept4$llc(r1, 0x0, &(0x7f0000000080), 0x80000) (async, rerun: 64) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) (rerun: 64) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = syz_io_uring_complete(0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0xdf, 0x3, 0x1, "a85a0ac3046554930f58f43bb4d23916c59c7ed14eab23bcd19ec25c353f260c3bf045c03274736d20167d97eaa3565fb041eafecb09bc1be3650bce67e257edea12187882266f4dad4e7dce21b6015080c5132b52214e9d69155553c1433fad3bb41bbb722ee4584156603984eb96e9c8950abd7b021ee76a998a3709e356e0a042e5c456c4402ae3a5c1cc4fa6a4fb1d894f7ffa0863609300f3df01993e7162a61f5d62289bba3acb86af74d8f69e6f931637386af202977ebd050657ab7de27f93b198f968634e7165306ceb75483b8bbee62e90cfaf9343f1d98c1df6"}) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x1, 0x20840) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) socketpair(0x26, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_void(r2, 0x1, 0x0, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:49 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x20000) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x200, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) syz_io_uring_setup(0x716b, &(0x7f0000000400)={0x0, 0x295, 0x20, 0x3, 0x18, 0x0, r2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) syz_io_uring_complete(r3) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 10:01:49 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20081, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x40000) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) uname(&(0x7f0000000400)=""/101) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000180)) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000600)={0x0, 0xf2f, 0x8, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_LOW_DMA(r3, 0x227a, &(0x7f0000000480)) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000001}, 0xc, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="100000000014000900000000000000040000003fd00a9114a899479f1e6dabd98ab60a728fdcd41c9ad2be21c42d276381f85235dbee5f2318429564f956f2b428e43257f73de92bfe4d6f450a7afd99bff50f5da0a36c8f202f07f3db09199f0b04f19ce892bc0a614dc23a50b1de2480a3bc5b6db6af0bb640daa652cf11aa0bc1790258ba42d54340e60acf73aee17b2a2ed2780a8da55db300000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000001}, 0x24000090) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 10:01:49 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000140)="8f6c4e7296bdafe3794c17ba20275b3a29be8ef6a98f3ccc1bc118afa02f3275ca0bee09f2b5d2d1a5d1194fabcbf5796033d57ca3602aa7557a3814c73db79b74e078c81fec9df6f8f7390be4d47ed3b6d665580339b78b87", &(0x7f00000001c0)=@udp=r0, 0x1}, 0x20) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000100)=0x1) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x5b77, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031400022cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a3200f6ff000800410073697700140033006261746164765f736c6176655f3000000900020073797a786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r3, 0x5382, &(0x7f0000000240)) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r3, 0x89f4, &(0x7f0000000800)={'syztnl2\x00', &(0x7f0000000780)={'ip6gre0\x00', 0x0, 0x2f, 0x5, 0xbb, 0xfffffffe, 0x22, @empty, @local, 0x20, 0x20, 0x3b7, 0x7}}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000001500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000014c0)={&(0x7f0000000840)={0xc44, 0x0, 0x2, 0x70bd29, 0x25dfdbfb, {}, [{{0x8}, {0xb4, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x1dc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x43f9}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x50d}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x41}}}]}}, {{0x8}, {0x254, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xff}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x1000, 0x75, 0x0, 0x9}, {0x81, 0x9, 0x9f, 0x90}, {0x2, 0x6, 0x6, 0x7f0000}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}]}}, {{0x8}, {0x110, 0x2, 0x0, 0x1, [{0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x0, 0x4, 0x2, 0x3}, {0x5, 0x1f, 0x1, 0x10000}, {0x68, 0x6, 0x20, 0x100}, {0x401, 0x80, 0x3, 0xfff}, {0xc0c5, 0x6, 0x5, 0x5}, {0x9, 0x4, 0x20}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}]}}, {{0x8}, {0x130, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x6, 0x4, 0x0, 0x3}, {0x800, 0x80, 0x5, 0x2}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x40}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0x1ac, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xe}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4bb20cb0}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xfc, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffff9}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2e7f}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x114, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0xc44}, 0x1, 0x0, 0x0, 0x24000840}, 0x4000) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = syz_io_uring_complete(0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000080)={0xdf, 0x3, 0x1, "a85a0ac3046554930f58f43bb4d23916c59c7ed14eab23bcd19ec25c353f260c3bf045c03274736d20167d97eaa3565fb041eafecb09bc1be3650bce67e257edea12187882266f4dad4e7dce21b6015080c5132b52214e9d69155553c1433fad3bb41bbb722ee4584156603984eb96e9c8950abd7b021ee76a998a3709e356e0a042e5c456c4402ae3a5c1cc4fa6a4fb1d894f7ffa0863609300f3df01993e7162a61f5d62289bba3acb86af74d8f69e6f931637386af202977ebd050657ab7de27f93b198f968634e7165306ceb75483b8bbee62e90cfaf9343f1d98c1df6"}) 10:01:49 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000140)="8f6c4e7296bdafe3794c17ba20275b3a29be8ef6a98f3ccc1bc118afa02f3275ca0bee09f2b5d2d1a5d1194fabcbf5796033d57ca3602aa7557a3814c73db79b74e078c81fec9df6f8f7390be4d47ed3b6d665580339b78b87", &(0x7f00000001c0)=@udp=r0, 0x1}, 0x20) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000100)=0x1) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_complete(r2) syz_io_uring_setup(0x5b77, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031400022cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a3200f6ff000800410073697700140033006261746164765f736c6176655f3000000900020073797a786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r3, 0x5382, &(0x7f0000000240)) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r3, 0x89f4, &(0x7f0000000800)={'syztnl2\x00', &(0x7f0000000780)={'ip6gre0\x00', 0x0, 0x2f, 0x5, 0xbb, 0xfffffffe, 0x22, @empty, @local, 0x20, 0x20, 0x3b7, 0x7}}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000001500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000014c0)={&(0x7f0000000840)={0xc44, 0x0, 0x2, 0x70bd29, 0x25dfdbfb, {}, [{{0x8}, {0xb4, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x1dc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x43f9}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x50d}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x41}}}]}}, {{0x8}, {0x254, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xff}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x1000, 0x75, 0x0, 0x9}, {0x81, 0x9, 0x9f, 0x90}, {0x2, 0x6, 0x6, 0x7f0000}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}]}}, {{0x8}, {0x110, 0x2, 0x0, 0x1, [{0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x0, 0x4, 0x2, 0x3}, {0x5, 0x1f, 0x1, 0x10000}, {0x68, 0x6, 0x20, 0x100}, {0x401, 0x80, 0x3, 0xfff}, {0xc0c5, 0x6, 0x5, 0x5}, {0x9, 0x4, 0x20}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}]}}, {{0x8}, {0x130, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x6, 0x4, 0x0, 0x3}, {0x800, 0x80, 0x5, 0x2}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x40}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0x1ac, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xe}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4bb20cb0}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xfc, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffff9}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2e7f}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x114, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0xc44}, 0x1, 0x0, 0x0, 0x24000840}, 0x4000) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r0, &(0x7f0000000140)="8f6c4e7296bdafe3794c17ba20275b3a29be8ef6a98f3ccc1bc118afa02f3275ca0bee09f2b5d2d1a5d1194fabcbf5796033d57ca3602aa7557a3814c73db79b74e078c81fec9df6f8f7390be4d47ed3b6d665580339b78b87", &(0x7f00000001c0)=@udp=r0, 0x1}, 0x20) (async) bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) (async) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000100)=0x1) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x5b77, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031400022cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a3200f6ff000800410073697700140033006261746164765f736c6176655f3000000900020073797a786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SCSI_IOCTL_GET_IDLUN(r3, 0x5382, &(0x7f0000000240)) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r3, 0x89f4, &(0x7f0000000800)={'syztnl2\x00', &(0x7f0000000780)={'ip6gre0\x00', 0x0, 0x2f, 0x5, 0xbb, 0xfffffffe, 0x22, @empty, @local, 0x20, 0x20, 0x3b7, 0x7}}) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000200)) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000001500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000014c0)={&(0x7f0000000840)={0xc44, 0x0, 0x2, 0x70bd29, 0x25dfdbfb, {}, [{{0x8}, {0xb4, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x1dc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x43f9}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x50d}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x41}}}]}}, {{0x8}, {0x254, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xff}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x1000, 0x75, 0x0, 0x9}, {0x81, 0x9, 0x9f, 0x90}, {0x2, 0x6, 0x6, 0x7f0000}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}]}}, {{0x8}, {0x110, 0x2, 0x0, 0x1, [{0x64, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x34, 0x4, [{0x0, 0x4, 0x2, 0x3}, {0x5, 0x1f, 0x1, 0x10000}, {0x68, 0x6, 0x20, 0x100}, {0x401, 0x80, 0x3, 0xfff}, {0xc0c5, 0x6, 0x5, 0x5}, {0x9, 0x4, 0x20}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}]}}, {{0x8}, {0x130, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x6, 0x4, 0x0, 0x3}, {0x800, 0x80, 0x5, 0x2}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x80}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x40}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}]}}, {{0x8}, {0x1ac, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xe}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffff}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x4bb20cb0}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xfc, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffff9}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2e7f}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x114, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0xc44}, 0x1, 0x0, 0x0, 0x24000840}, 0x4000) (async) 10:01:49 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x20000) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x200, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) write$P9_RREADLINK(r2, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) syz_io_uring_setup(0x716b, &(0x7f0000000400)={0x0, 0x295, 0x20, 0x3, 0x18, 0x0, r2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) syz_io_uring_complete(r3) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 10:01:49 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20081, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x40000) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) uname(&(0x7f0000000400)=""/101) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000180)) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000600)={0x0, 0xf2f, 0x8, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 64) ioctl$SG_GET_LOW_DMA(r3, 0x227a, &(0x7f0000000480)) (rerun: 64) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000001}, 0xc, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="100000000014000900000000000000040000003fd00a9114a899479f1e6dabd98ab60a728fdcd41c9ad2be21c42d276381f85235dbee5f2318429564f956f2b428e43257f73de92bfe4d6f450a7afd99bff50f5da0a36c8f202f07f3db09199f0b04f19ce892bc0a614dc23a50b1de2480a3bc5b6db6af0bb640daa652cf11aa0bc1790258ba42d54340e60acf73aee17b2a2ed2780a8da55db300000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000001}, 0x24000090) (async, rerun: 64) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (rerun: 64) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x1, 0x20840) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) socketpair(0x26, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_void(r2, 0x1, 0x0, 0x0, 0x0) (async) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) (async) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:49 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20081, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, 0x0, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x1}, @GTPA_I_TEI={0x8, 0x8, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x40000) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x9) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x9) 10:01:49 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) uname(&(0x7f0000000400)=""/101) (async) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000180)) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000600)={0x0, 0xf2f, 0x8, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_LOW_DMA(r3, 0x227a, &(0x7f0000000480)) (async) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000001}, 0xc, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="100000000014000900000000000000040000003fd00a9114a899479f1e6dabd98ab60a728fdcd41c9ad2be21c42d276381f85235dbee5f2318429564f956f2b428e43257f73de92bfe4d6f450a7afd99bff50f5da0a36c8f202f07f3db09199f0b04f19ce892bc0a614dc23a50b1de2480a3bc5b6db6af0bb640daa652cf11aa0bc1790258ba42d54340e60acf73aee17b2a2ed2780a8da55db300000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20000001}, 0x24000090) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 10:01:49 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="16002f62730000000000000008"], 0x87ffff2) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async, rerun: 32) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x9) (rerun: 32) 10:01:49 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x20000) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x200, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) syz_io_uring_setup(0x716b, &(0x7f0000000400)={0x0, 0x295, 0x20, 0x3, 0x18, 0x0, r2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) syz_io_uring_complete(r3) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 10:01:49 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x1, 0x20840) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) socketpair(0x26, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_void(r2, 0x1, 0x0, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x1, 0x20840) (async) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) (async) socketpair(0x26, 0x1, 0x0, &(0x7f0000000100)) (async) setsockopt$sock_void(r2, 0x1, 0x0, 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r3) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) (async) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) 10:01:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x9) 10:01:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x9) 10:01:49 executing program 5: pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x2, {{0x80, 0x2, 0x3}, 0x80000001}}, 0x18) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 5: pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x2, {{0x80, 0x2, 0x3}, 0x80000001}}, 0x18) (async, rerun: 32) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (rerun: 32) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:49 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r2, 0x8000000) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000400)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) getsockopt$llc_int(r1, 0x10c, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x1000000002, 0x2000) ioctl$SG_GET_NUM_WAITING(r3, 0x2270, &(0x7f0000000000)) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), r5) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x9) 10:01:50 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000002300)={0x0, 0xfffffffffffffffc, 0x1000, 0x3, @scatter={0x9, 0x0, &(0x7f0000000700)=[{&(0x7f0000000100)=""/118, 0x76}, {&(0x7f0000000180)=""/131, 0x83}, {&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/156, 0x9c}, {&(0x7f0000000400)=""/32, 0x20}, {&(0x7f0000002500)=""/4096, 0x1000}, {&(0x7f0000000440)=""/203, 0xcb}, {&(0x7f0000000540)=""/240, 0xf0}, {&(0x7f0000000640)=""/169, 0xa9}]}, &(0x7f0000001280)="22dfb82f22c15c0782704b4247fb24e7f37f41986909e5ba3d5662432850c1e14af50b65e4d9cea85f02eb54231976b547049cefc9678d13814523ac608c7e2d8d194d2b3cd423b04660c784263a0d9dc73f1e7a16afd757cd30217d7eb27f496de343037f32b3f71e73ad8a2a5a1a6644a59d9b964df5a784d3874dab4e8a9ecd7bb85543521569e9c396b4d5fa0a3620d020ceae1713f9c78375ca330a4791cccda20db5ed97c8a19650637f9831732bf3f990e23e9d9241adb06562d374db73c71eb47568a6c6591689218fedd63c20f875f6839f1992b3e3da1fcec9e3a75077a49009bee524fb63b59f423ca015d4f68fed8eaf58911da3839d3154fb585d05b92fdfa3780eea151d9888feb32dcd6c8873c9ae3a0390c4337f7ed84c5552896102630c67d3e9f390cd9687c8fa834baeb09c433165b5762a168260b19197d22b70518788797639274e76b6277decc6d4d88e972eb450c59867a9189aac3c421c544baa5928e1f16b02a5397ec491b510d4b029d8e18eddc3d788aae86e09e1f154ec384b87a8285408a133d9e6343bddda7dc5a4bf5976a674971666f138d7d6728eccba5f2939113fb0fdf156e07459069a97aac54753195b7fd186fcf1e3cd9cbea0d0c64f5bd0e19e34990b5d2b0df2ab949cb9ca82e55d4f708028be01ea015b33601bc843c8a2e005834caf6ed198aa054f7976b03dde3b83be711da5776d0cb9d7dcb9feb95eff51a15185d20e06fbe63adb1930c855b3f165d9adadfb2ca9895b236b439e2df9ad09212873ad1582c2db1f8e8da613bc6aa7ff2fb9db703e0879d56acb98e47889e2e1fd019ccb42cbdeac1777b8efccba604a5da5f5f69aea9eb0249b08df63ceff8d2b7dda855e3065977e43349452661ac8b99c1bf4ad7ed237e37932e6f0ff603073a5d0babc7a4bcdcccbd4b4952060670081671aaea075ea1f20fbccafa4b42e315651ec216523888f4ab690f130465f392378d8384d8fc839f4dd44b69a38cba18e7f64e9b3475499d7a87c3029d2668616815045c0fd857c6136bb5759a7a1f8dfd099186f2c289e3e0dfbac27965019527c878641cdf10fc714bc776df7e96416355aaba94c18896a631b32742c1519a487846fa1ac94f2a3525742892d86d123a47fccc21c0e0646626df6dd545998cc03b7d468e7d683432ce8505c807bf6bea66a1f97999779ee69c93973e240e6b6317c6ebadac9c1340f40ee80e82db6e518bfa5d4ee2f75571b86b8af2352178c7f3e91c5034f8b0f11cb1c1b619e14684cb837dfe488ad0d90b447a191f7039f15214244f3c206f41a4a6abc9d4d2dd459f6b2dd55c6b0b788a5e44950f0704dab9c977b8d0579fb4d5bc96ff4d71449f82802102e1da5fccb66ef9f0941ac92e26b9d353af07cede04aaf090f06a264f0ff16e98056fc22d5ced1be4bdf79ce525e66d2ce5661b07dbef89d7d77c57258161f300714452823948efe69e8cd32b2f4fb7b6f9c745a4b024fcb7f8a41269732180b5a7717d801a2c8c3b1ec87bc24ffb22cdde552cfe843737a2904c86a65aebc23e25e87c022676c0ece9d216e2bb224f7735395324d681bdac56712f4bd2c62a896f4fa8989c232545995dab112c14801f8597214851433c1d14bc5c4a202006de592dc3122cd35c31b9057efd98bc0b1b44e5346f2093e2a828ef9a06a58ed21f10b39bfe4e705cb07faf222cbf3e1508d7a61b897eb73e4d77c6d4ad309cdfc130c48ae8f9fc2e337ae73303ea5a7d4471296d7e3bc654fcf7ce77d4d9ee6e90207bb51a1756a107010870a7e9f9f8cd49f77f8ee847286ed7c36cabb74c48a5b5da118416eef3ffcb79b3d4b9163aef84009226dd92ec7c90a764c979ba743d009731dd77b2b223105a1c377dcf31691d7d84e9359fc6f64aacc57553c6edf547c2360cb956a0aca435744f1ebf08a15f1259b7d9ad563f833b356c9d75c700ffdbdf94e7fdc47f0df0c99792cce0f3d89974ce1cc4c60da2ab87e30de84640fffa0d4827bf2881b6a18c97b766be74369d6091a722ab53e124ffd5af9225a482d3dbc0f2b7d206a69452b1cd813c7ebb23f49ffd267edf9bde00ae170c8cf7f03d27d3e509b9636ee08ed8865cfd14c9f1b5a79abbb23814b17c0e875858b5cf520278c2b5df646d31bfc9f90e3daab09fcd69b0c32075d9de4e100307cf5528457ff9dd3cdc3765dcae26752f05190d458ee730adee316110193664da192cc9e3dd5895c793808769d59b734d1e2334df7536787843b28d46a92c28ec6736c8ef9ae1c6518474fdd791eb6bc0f3c35b62da01fc432e8818fb6b05b101bf79f5a1a48300c983e4bc565664bc453cc0d835709fb9e4b5bd23105a3cc91372986546198eeaa8ffe4c62e6dd7ee30b614962ce8817f5f51c8de4d47d77389a4d45cb2af8718681f8525f807aaf7ef096adde608a242a0642887d5e02577f81aabce53cc90c3226c182d46ff2cc2972c128f218579272116ce2fcb2aaf089d2b56329d03e27ae6ed7b3d93bf04ba92739dab03b1230ca55e085407386558cb2d4e5e5c8e0bda0d839024fbfafd5e1810a6fb43defea11b8a43fe4a89dec354e035ed883e88e36ee16918a423f380e22e9a463752091eeab49b4eff3ebf89e1dd3eaef9e99c9d297f54bb0dee831621a9a13e386e8328feb05c485a834927a476a9ad6ce6e0f0e032fa01dcd0241bebf1437a87d87225fd36149c111fd02f30823d680a12f8427c07d6074f57d80c0a7c9005fa2f5f2ea19f3a819ba3c1aecc25fde6dc3991e82ffc060e429c66868c2af3f6b66a79246e9792c06b649520cee00936ad7ae0a0072f6219516d72e268fbe3353321e95589201ec3b53a0d1518e81c0c9c69ad284fb2dd7fbc62e205b70151e3a32ebb15264ade903d695e96e036f67176c4a3dadebbf4acb6b8f5e69549d87252ec8b2258ed1f7e25aa0209eb0010e41327c3f85a8ef9248d23002bb069aa37933fc9449597062a94a2bb5bd997fdfc48a014cefe5f21cd0ec937bdb78c9dde6c53aa6fcdaf4923091df19ae576d1f6be324bc005362628e68108682ccd73ff3c54278eef21941a2b03450e3508bb2747d06e49b97dcd8e71ac931d3d53b71cdd408b60962e951ca06b70b46341457fa0dbf5a0a3269d1223870f92929f7150b0de25d516b8150169584d7845f610a59b497b42a85353e926c010ea6d8fc84eb74d34d555c44282738e369664f151294ec21c82456df64d319d183dcb2d8e48e52de8fc8a08812ab783d67baa8b6e04832a471324bb60d697e8613d904b04ec8a2917543f0743ca8cdc30fdf131183c3ee3afad9e611a566d427ca925fd9f32698c4ee51f28aec45f3c2b9d47169c373b85aab02200d499d9995d4dcf7742f1ad6bacba1d06b338f5742202eb05eaea5c682db7e35dc4351df66c09ab8c6225c5ace3575a593460a2b5445d5862ab0c2db5378660484a384e2e84272ccf5ee27950ff58fe44ccccbd213674fa6c02b0f679edb4dfeae9930b3381a26e148f8dee3404e4610f6ef7a56caea4094c4cee37a1df161800b9e1e19d6439698970a88e1d6f6888ccef6508f6ef416caae7d251af8fa0dd2bcb91da4b8a4102f5074b589df0ce218fff81e0f33be453c9145a72870608f88006d3b72e1a6296ae72247f0c5eb5bac77bcc4b3d09202da981b2676ac92e73911095380fce99e9e4664b6e284938cdbd34df806a67858141fa3bac06b48ea7fc985b274131d2aea8fa3f65f69ad0fb00a101f338204d74c5f8b9c651468b7611a369e1fb5ab74cb3783dc6d79a8694f2dbe9ef20005719cc60754d99a54dd6438db183b2e104b702aa4e3bf6f9cd1d6662deeaf97a6dcf2abb97929e2fedb82001cb95e4eeee01884a6f0490d9ab54190de2a0fcce6719400b3db02a041a1a97285578add4db617d4b79326f30ce37ac2ae4f5269b994224b0c888fc5718d6464b61119c041ca523b7c512dd1025df72487bfd5b0ffd825874a8274e4e93e4bea22308e085ce83d529d538a86c1cc11d91702c04966058b7541d6dea4f07090eb0928c6c1766bff5e848ff9c402ee2c61394237e96239b4b0db51d7aaa9e96c3fa666c98a822b30f9aef5984f33e9729175fef0dbcec6e1cbd8d69ad19cf8c6be738ea6475c09889b272e2eda57582b9dc304612f95bf864ffb721768528f7af49393c5bd92644b90eda019c8ec4668507ecedbf50381b5349d5c3e6a72bddf2004c68383749e5022c69034f583ce47b69073fc7e7c9f3ec7296d73248bd09185e2be91cf679f38b75d0eaa3715e634ef7db1acd0b2d4e1c79693e69e5910671e47903794dc86891173a297855556d9313088248110e88a7d4ae3f0091e000b90543bf7efd6e0211d652ec2c32bf9353a6478fb7949f1ac0c3617707ce742d8b0f730d803e0ff9c95fd22add52d7d3f873b9897bbd740197c839f88f3d1d5abe57fdefbdbfa918928666530e38cc2e9645db69988d0bfbc76a0d665f9dfbceae0cce8e0960539ad0313c89c862c486f8382265e384a36a1a3c19edbc1c1916a35f143004bcd3305ea05def6aaf42d62c7ed9a393d16a784ee4aad0b62b26b10ed03f2e2f820ed10592afdc5eb7a23c7ef3f3849885bc1fddcbe2ba49cace4e87e54af29a7f348d7c2a397e61c8edbfd5023d5be964104663f0c36a9fe157a1f1008b8dfbc1c22fe85aa560283703077950cf628de71ce32438a9c849560d857f6eb8fd71361296c316e94f08abe6091eabb6308de616be0d5f967ce0364d46cba92ef56492f60c563a05c0a7d5f620586ff49999297034aa81d8ce81e6292e2f5995459d8852a7b95cdb1708a50c9f933a5548efab41f18d4abda4a1a22d8ac0b95ecbff6700d1159c92b5c27c5f19502e28c31469b90aeefdaf26d8df6bd3379ac49e8d5a349942633ba62ddafeef3a377282c628481e4e13cdc88a094606c082eb625bc6847a032e4e3fd3e4c25fc86ecf3ceb1be01b9e92fc5ce61e340e13b7de580a691e35c250aed06fcf5d882ab82b6dfbf667998d334bbff39ab08cf91e3e99351fb8d9453df25fe95457dcb9ddee3aee23dd1569ce1e9c075414f507c5c907a9c7dc1f0f9d4bf910763a88ee76ae70e53b3a0f0969ee2b87b5a50e574a94d33707e99223ee4a49ee3ea99c4e96c3ebf081e10285cf686fa648dc7804c1637de76192114bd4bb5123e753cc3127dbed66ac010a8c679bdba8e8b5c594e6e9d4365dad53d7d026d9d761458131184916508e81c1a47713aa743699da18c32bb9012453826ab1287c79a0a35456e124304bf16bdc518c5bbae34b35bd37282720426f40eaa4a476dc015627dc5cabfc83ff57b25bd41094adcdcfb3605c96ecc89d3ea6c05ccb2cc4bfbaa53c36462dc1ecadd33871dc3e5aec88e5f0d74ee8201acf26c649db12b65f4660dd0bc2c1d26a9f97f7cdf00eb87b100556bce90c1dcced04e2a8199a7d43a99083e90b5a519d55e7b9daf25785c3eec4c26e397938e019c8a63942d85fe475658a0094a68e47574e4d92e748da2b35d09aacca24bfadb2b1d96d2b2f90a6a95055d8d423f164f444c649f5acf4a7216cc32aea155d237932c41165a694878ee1d4714b1777ba5d0baab37e5d171024a8013a500dadb9568ad80baa37cb707a56e23a0d6cc4d27168fe14438faa6292cec2adfc36b1b8aea925393c93546fffdac8f78c7106db9450de356259187e3ee0f895bb67ebfaf038c7f866d6571a2cd9138e756a0122464985cdfbe1f5942b8ddcd6fad4a", &(0x7f0000002280)=""/20, 0x9, 0x11, 0x1, &(0x7f00000022c0)}) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000002440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002400)={&(0x7f0000002380)={0x48, 0x0, 0x100, 0x70bd2a, 0x0, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x64}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6a}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4048001}, 0x80) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000740)={0x0, 0xfffffffffffffffc, 0x3e, 0x1, @scatter={0x4, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000280)=""/206, 0xce}, {&(0x7f0000000380)=""/202, 0xca}, {&(0x7f0000000480)=""/83, 0x53}, {&(0x7f0000000500)=""/169, 0xa9}]}, &(0x7f0000000600)="89f4b9830b40b4f056116690ba5500abf7c52a50e02cf98eaee965eed83d9107c7e1490818bd443fc9a052033c7ed1fbc8c24de5829e728c655576dda77d", &(0x7f0000000640)=""/166, 0x1f, 0x20, 0xffffffffffffffff, &(0x7f0000000700)}) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r2 = syz_io_uring_complete(0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000200)) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x54, 0x0, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x82}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xfffffffffffffff7}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'hsr0\x00'}, @L2TP_ATTR_DEBUG={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x20008806}, 0x4000) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000007c0)={r2}, 0x8) setsockopt$SO_J1939_PROMISC(r3, 0x6b, 0x2, &(0x7f0000000800), 0x4) 10:01:50 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="16002f62730000000000000008"], 0x87ffff2) 10:01:50 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000002300)={0x0, 0xfffffffffffffffc, 0x1000, 0x3, @scatter={0x9, 0x0, &(0x7f0000000700)=[{&(0x7f0000000100)=""/118, 0x76}, {&(0x7f0000000180)=""/131, 0x83}, {&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/156, 0x9c}, {&(0x7f0000000400)=""/32, 0x20}, {&(0x7f0000002500)=""/4096, 0x1000}, {&(0x7f0000000440)=""/203, 0xcb}, {&(0x7f0000000540)=""/240, 0xf0}, {&(0x7f0000000640)=""/169, 0xa9}]}, &(0x7f0000001280)="22dfb82f22c15c0782704b4247fb24e7f37f41986909e5ba3d5662432850c1e14af50b65e4d9cea85f02eb54231976b547049cefc9678d13814523ac608c7e2d8d194d2b3cd423b04660c784263a0d9dc73f1e7a16afd757cd30217d7eb27f496de343037f32b3f71e73ad8a2a5a1a6644a59d9b964df5a784d3874dab4e8a9ecd7bb85543521569e9c396b4d5fa0a3620d020ceae1713f9c78375ca330a4791cccda20db5ed97c8a19650637f9831732bf3f990e23e9d9241adb06562d374db73c71eb47568a6c6591689218fedd63c20f875f6839f1992b3e3da1fcec9e3a75077a49009bee524fb63b59f423ca015d4f68fed8eaf58911da3839d3154fb585d05b92fdfa3780eea151d9888feb32dcd6c8873c9ae3a0390c4337f7ed84c5552896102630c67d3e9f390cd9687c8fa834baeb09c433165b5762a168260b19197d22b70518788797639274e76b6277decc6d4d88e972eb450c59867a9189aac3c421c544baa5928e1f16b02a5397ec491b510d4b029d8e18eddc3d788aae86e09e1f154ec384b87a8285408a133d9e6343bddda7dc5a4bf5976a674971666f138d7d6728eccba5f2939113fb0fdf156e07459069a97aac54753195b7fd186fcf1e3cd9cbea0d0c64f5bd0e19e34990b5d2b0df2ab949cb9ca82e55d4f708028be01ea015b33601bc843c8a2e005834caf6ed198aa054f7976b03dde3b83be711da5776d0cb9d7dcb9feb95eff51a15185d20e06fbe63adb1930c855b3f165d9adadfb2ca9895b236b439e2df9ad09212873ad1582c2db1f8e8da613bc6aa7ff2fb9db703e0879d56acb98e47889e2e1fd019ccb42cbdeac1777b8efccba604a5da5f5f69aea9eb0249b08df63ceff8d2b7dda855e3065977e43349452661ac8b99c1bf4ad7ed237e37932e6f0ff603073a5d0babc7a4bcdcccbd4b4952060670081671aaea075ea1f20fbccafa4b42e315651ec216523888f4ab690f130465f392378d8384d8fc839f4dd44b69a38cba18e7f64e9b3475499d7a87c3029d2668616815045c0fd857c6136bb5759a7a1f8dfd099186f2c289e3e0dfbac27965019527c878641cdf10fc714bc776df7e96416355aaba94c18896a631b32742c1519a487846fa1ac94f2a3525742892d86d123a47fccc21c0e0646626df6dd545998cc03b7d468e7d683432ce8505c807bf6bea66a1f97999779ee69c93973e240e6b6317c6ebadac9c1340f40ee80e82db6e518bfa5d4ee2f75571b86b8af2352178c7f3e91c5034f8b0f11cb1c1b619e14684cb837dfe488ad0d90b447a191f7039f15214244f3c206f41a4a6abc9d4d2dd459f6b2dd55c6b0b788a5e44950f0704dab9c977b8d0579fb4d5bc96ff4d71449f82802102e1da5fccb66ef9f0941ac92e26b9d353af07cede04aaf090f06a264f0ff16e98056fc22d5ced1be4bdf79ce525e66d2ce5661b07dbef89d7d77c57258161f300714452823948efe69e8cd32b2f4fb7b6f9c745a4b024fcb7f8a41269732180b5a7717d801a2c8c3b1ec87bc24ffb22cdde552cfe843737a2904c86a65aebc23e25e87c022676c0ece9d216e2bb224f7735395324d681bdac56712f4bd2c62a896f4fa8989c232545995dab112c14801f8597214851433c1d14bc5c4a202006de592dc3122cd35c31b9057efd98bc0b1b44e5346f2093e2a828ef9a06a58ed21f10b39bfe4e705cb07faf222cbf3e1508d7a61b897eb73e4d77c6d4ad309cdfc130c48ae8f9fc2e337ae73303ea5a7d4471296d7e3bc654fcf7ce77d4d9ee6e90207bb51a1756a107010870a7e9f9f8cd49f77f8ee847286ed7c36cabb74c48a5b5da118416eef3ffcb79b3d4b9163aef84009226dd92ec7c90a764c979ba743d009731dd77b2b223105a1c377dcf31691d7d84e9359fc6f64aacc57553c6edf547c2360cb956a0aca435744f1ebf08a15f1259b7d9ad563f833b356c9d75c700ffdbdf94e7fdc47f0df0c99792cce0f3d89974ce1cc4c60da2ab87e30de84640fffa0d4827bf2881b6a18c97b766be74369d6091a722ab53e124ffd5af9225a482d3dbc0f2b7d206a69452b1cd813c7ebb23f49ffd267edf9bde00ae170c8cf7f03d27d3e509b9636ee08ed8865cfd14c9f1b5a79abbb23814b17c0e875858b5cf520278c2b5df646d31bfc9f90e3daab09fcd69b0c32075d9de4e100307cf5528457ff9dd3cdc3765dcae26752f05190d458ee730adee316110193664da192cc9e3dd5895c793808769d59b734d1e2334df7536787843b28d46a92c28ec6736c8ef9ae1c6518474fdd791eb6bc0f3c35b62da01fc432e8818fb6b05b101bf79f5a1a48300c983e4bc565664bc453cc0d835709fb9e4b5bd23105a3cc91372986546198eeaa8ffe4c62e6dd7ee30b614962ce8817f5f51c8de4d47d77389a4d45cb2af8718681f8525f807aaf7ef096adde608a242a0642887d5e02577f81aabce53cc90c3226c182d46ff2cc2972c128f218579272116ce2fcb2aaf089d2b56329d03e27ae6ed7b3d93bf04ba92739dab03b1230ca55e085407386558cb2d4e5e5c8e0bda0d839024fbfafd5e1810a6fb43defea11b8a43fe4a89dec354e035ed883e88e36ee16918a423f380e22e9a463752091eeab49b4eff3ebf89e1dd3eaef9e99c9d297f54bb0dee831621a9a13e386e8328feb05c485a834927a476a9ad6ce6e0f0e032fa01dcd0241bebf1437a87d87225fd36149c111fd02f30823d680a12f8427c07d6074f57d80c0a7c9005fa2f5f2ea19f3a819ba3c1aecc25fde6dc3991e82ffc060e429c66868c2af3f6b66a79246e9792c06b649520cee00936ad7ae0a0072f6219516d72e268fbe3353321e95589201ec3b53a0d1518e81c0c9c69ad284fb2dd7fbc62e205b70151e3a32ebb15264ade903d695e96e036f67176c4a3dadebbf4acb6b8f5e69549d87252ec8b2258ed1f7e25aa0209eb0010e41327c3f85a8ef9248d23002bb069aa37933fc9449597062a94a2bb5bd997fdfc48a014cefe5f21cd0ec937bdb78c9dde6c53aa6fcdaf4923091df19ae576d1f6be324bc005362628e68108682ccd73ff3c54278eef21941a2b03450e3508bb2747d06e49b97dcd8e71ac931d3d53b71cdd408b60962e951ca06b70b46341457fa0dbf5a0a3269d1223870f92929f7150b0de25d516b8150169584d7845f610a59b497b42a85353e926c010ea6d8fc84eb74d34d555c44282738e369664f151294ec21c82456df64d319d183dcb2d8e48e52de8fc8a08812ab783d67baa8b6e04832a471324bb60d697e8613d904b04ec8a2917543f0743ca8cdc30fdf131183c3ee3afad9e611a566d427ca925fd9f32698c4ee51f28aec45f3c2b9d47169c373b85aab02200d499d9995d4dcf7742f1ad6bacba1d06b338f5742202eb05eaea5c682db7e35dc4351df66c09ab8c6225c5ace3575a593460a2b5445d5862ab0c2db5378660484a384e2e84272ccf5ee27950ff58fe44ccccbd213674fa6c02b0f679edb4dfeae9930b3381a26e148f8dee3404e4610f6ef7a56caea4094c4cee37a1df161800b9e1e19d6439698970a88e1d6f6888ccef6508f6ef416caae7d251af8fa0dd2bcb91da4b8a4102f5074b589df0ce218fff81e0f33be453c9145a72870608f88006d3b72e1a6296ae72247f0c5eb5bac77bcc4b3d09202da981b2676ac92e73911095380fce99e9e4664b6e284938cdbd34df806a67858141fa3bac06b48ea7fc985b274131d2aea8fa3f65f69ad0fb00a101f338204d74c5f8b9c651468b7611a369e1fb5ab74cb3783dc6d79a8694f2dbe9ef20005719cc60754d99a54dd6438db183b2e104b702aa4e3bf6f9cd1d6662deeaf97a6dcf2abb97929e2fedb82001cb95e4eeee01884a6f0490d9ab54190de2a0fcce6719400b3db02a041a1a97285578add4db617d4b79326f30ce37ac2ae4f5269b994224b0c888fc5718d6464b61119c041ca523b7c512dd1025df72487bfd5b0ffd825874a8274e4e93e4bea22308e085ce83d529d538a86c1cc11d91702c04966058b7541d6dea4f07090eb0928c6c1766bff5e848ff9c402ee2c61394237e96239b4b0db51d7aaa9e96c3fa666c98a822b30f9aef5984f33e9729175fef0dbcec6e1cbd8d69ad19cf8c6be738ea6475c09889b272e2eda57582b9dc304612f95bf864ffb721768528f7af49393c5bd92644b90eda019c8ec4668507ecedbf50381b5349d5c3e6a72bddf2004c68383749e5022c69034f583ce47b69073fc7e7c9f3ec7296d73248bd09185e2be91cf679f38b75d0eaa3715e634ef7db1acd0b2d4e1c79693e69e5910671e47903794dc86891173a297855556d9313088248110e88a7d4ae3f0091e000b90543bf7efd6e0211d652ec2c32bf9353a6478fb7949f1ac0c3617707ce742d8b0f730d803e0ff9c95fd22add52d7d3f873b9897bbd740197c839f88f3d1d5abe57fdefbdbfa918928666530e38cc2e9645db69988d0bfbc76a0d665f9dfbceae0cce8e0960539ad0313c89c862c486f8382265e384a36a1a3c19edbc1c1916a35f143004bcd3305ea05def6aaf42d62c7ed9a393d16a784ee4aad0b62b26b10ed03f2e2f820ed10592afdc5eb7a23c7ef3f3849885bc1fddcbe2ba49cace4e87e54af29a7f348d7c2a397e61c8edbfd5023d5be964104663f0c36a9fe157a1f1008b8dfbc1c22fe85aa560283703077950cf628de71ce32438a9c849560d857f6eb8fd71361296c316e94f08abe6091eabb6308de616be0d5f967ce0364d46cba92ef56492f60c563a05c0a7d5f620586ff49999297034aa81d8ce81e6292e2f5995459d8852a7b95cdb1708a50c9f933a5548efab41f18d4abda4a1a22d8ac0b95ecbff6700d1159c92b5c27c5f19502e28c31469b90aeefdaf26d8df6bd3379ac49e8d5a349942633ba62ddafeef3a377282c628481e4e13cdc88a094606c082eb625bc6847a032e4e3fd3e4c25fc86ecf3ceb1be01b9e92fc5ce61e340e13b7de580a691e35c250aed06fcf5d882ab82b6dfbf667998d334bbff39ab08cf91e3e99351fb8d9453df25fe95457dcb9ddee3aee23dd1569ce1e9c075414f507c5c907a9c7dc1f0f9d4bf910763a88ee76ae70e53b3a0f0969ee2b87b5a50e574a94d33707e99223ee4a49ee3ea99c4e96c3ebf081e10285cf686fa648dc7804c1637de76192114bd4bb5123e753cc3127dbed66ac010a8c679bdba8e8b5c594e6e9d4365dad53d7d026d9d761458131184916508e81c1a47713aa743699da18c32bb9012453826ab1287c79a0a35456e124304bf16bdc518c5bbae34b35bd37282720426f40eaa4a476dc015627dc5cabfc83ff57b25bd41094adcdcfb3605c96ecc89d3ea6c05ccb2cc4bfbaa53c36462dc1ecadd33871dc3e5aec88e5f0d74ee8201acf26c649db12b65f4660dd0bc2c1d26a9f97f7cdf00eb87b100556bce90c1dcced04e2a8199a7d43a99083e90b5a519d55e7b9daf25785c3eec4c26e397938e019c8a63942d85fe475658a0094a68e47574e4d92e748da2b35d09aacca24bfadb2b1d96d2b2f90a6a95055d8d423f164f444c649f5acf4a7216cc32aea155d237932c41165a694878ee1d4714b1777ba5d0baab37e5d171024a8013a500dadb9568ad80baa37cb707a56e23a0d6cc4d27168fe14438faa6292cec2adfc36b1b8aea925393c93546fffdac8f78c7106db9450de356259187e3ee0f895bb67ebfaf038c7f866d6571a2cd9138e756a0122464985cdfbe1f5942b8ddcd6fad4a", &(0x7f0000002280)=""/20, 0x9, 0x11, 0x1, &(0x7f00000022c0)}) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000002440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002400)={&(0x7f0000002380)={0x48, 0x0, 0x100, 0x70bd2a, 0x0, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x64}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6a}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4048001}, 0x80) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) (async) ioctl$SG_IO(r0, 0x2285, &(0x7f0000002300)={0x0, 0xfffffffffffffffc, 0x1000, 0x3, @scatter={0x9, 0x0, &(0x7f0000000700)=[{&(0x7f0000000100)=""/118, 0x76}, {&(0x7f0000000180)=""/131, 0x83}, {&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/156, 0x9c}, {&(0x7f0000000400)=""/32, 0x20}, {&(0x7f0000002500)=""/4096, 0x1000}, {&(0x7f0000000440)=""/203, 0xcb}, {&(0x7f0000000540)=""/240, 0xf0}, {&(0x7f0000000640)=""/169, 0xa9}]}, &(0x7f0000001280)="22dfb82f22c15c0782704b4247fb24e7f37f41986909e5ba3d5662432850c1e14af50b65e4d9cea85f02eb54231976b547049cefc9678d13814523ac608c7e2d8d194d2b3cd423b04660c784263a0d9dc73f1e7a16afd757cd30217d7eb27f496de343037f32b3f71e73ad8a2a5a1a6644a59d9b964df5a784d3874dab4e8a9ecd7bb85543521569e9c396b4d5fa0a3620d020ceae1713f9c78375ca330a4791cccda20db5ed97c8a19650637f9831732bf3f990e23e9d9241adb06562d374db73c71eb47568a6c6591689218fedd63c20f875f6839f1992b3e3da1fcec9e3a75077a49009bee524fb63b59f423ca015d4f68fed8eaf58911da3839d3154fb585d05b92fdfa3780eea151d9888feb32dcd6c8873c9ae3a0390c4337f7ed84c5552896102630c67d3e9f390cd9687c8fa834baeb09c433165b5762a168260b19197d22b70518788797639274e76b6277decc6d4d88e972eb450c59867a9189aac3c421c544baa5928e1f16b02a5397ec491b510d4b029d8e18eddc3d788aae86e09e1f154ec384b87a8285408a133d9e6343bddda7dc5a4bf5976a674971666f138d7d6728eccba5f2939113fb0fdf156e07459069a97aac54753195b7fd186fcf1e3cd9cbea0d0c64f5bd0e19e34990b5d2b0df2ab949cb9ca82e55d4f708028be01ea015b33601bc843c8a2e005834caf6ed198aa054f7976b03dde3b83be711da5776d0cb9d7dcb9feb95eff51a15185d20e06fbe63adb1930c855b3f165d9adadfb2ca9895b236b439e2df9ad09212873ad1582c2db1f8e8da613bc6aa7ff2fb9db703e0879d56acb98e47889e2e1fd019ccb42cbdeac1777b8efccba604a5da5f5f69aea9eb0249b08df63ceff8d2b7dda855e3065977e43349452661ac8b99c1bf4ad7ed237e37932e6f0ff603073a5d0babc7a4bcdcccbd4b4952060670081671aaea075ea1f20fbccafa4b42e315651ec216523888f4ab690f130465f392378d8384d8fc839f4dd44b69a38cba18e7f64e9b3475499d7a87c3029d2668616815045c0fd857c6136bb5759a7a1f8dfd099186f2c289e3e0dfbac27965019527c878641cdf10fc714bc776df7e96416355aaba94c18896a631b32742c1519a487846fa1ac94f2a3525742892d86d123a47fccc21c0e0646626df6dd545998cc03b7d468e7d683432ce8505c807bf6bea66a1f97999779ee69c93973e240e6b6317c6ebadac9c1340f40ee80e82db6e518bfa5d4ee2f75571b86b8af2352178c7f3e91c5034f8b0f11cb1c1b619e14684cb837dfe488ad0d90b447a191f7039f15214244f3c206f41a4a6abc9d4d2dd459f6b2dd55c6b0b788a5e44950f0704dab9c977b8d0579fb4d5bc96ff4d71449f82802102e1da5fccb66ef9f0941ac92e26b9d353af07cede04aaf090f06a264f0ff16e98056fc22d5ced1be4bdf79ce525e66d2ce5661b07dbef89d7d77c57258161f300714452823948efe69e8cd32b2f4fb7b6f9c745a4b024fcb7f8a41269732180b5a7717d801a2c8c3b1ec87bc24ffb22cdde552cfe843737a2904c86a65aebc23e25e87c022676c0ece9d216e2bb224f7735395324d681bdac56712f4bd2c62a896f4fa8989c232545995dab112c14801f8597214851433c1d14bc5c4a202006de592dc3122cd35c31b9057efd98bc0b1b44e5346f2093e2a828ef9a06a58ed21f10b39bfe4e705cb07faf222cbf3e1508d7a61b897eb73e4d77c6d4ad309cdfc130c48ae8f9fc2e337ae73303ea5a7d4471296d7e3bc654fcf7ce77d4d9ee6e90207bb51a1756a107010870a7e9f9f8cd49f77f8ee847286ed7c36cabb74c48a5b5da118416eef3ffcb79b3d4b9163aef84009226dd92ec7c90a764c979ba743d009731dd77b2b223105a1c377dcf31691d7d84e9359fc6f64aacc57553c6edf547c2360cb956a0aca435744f1ebf08a15f1259b7d9ad563f833b356c9d75c700ffdbdf94e7fdc47f0df0c99792cce0f3d89974ce1cc4c60da2ab87e30de84640fffa0d4827bf2881b6a18c97b766be74369d6091a722ab53e124ffd5af9225a482d3dbc0f2b7d206a69452b1cd813c7ebb23f49ffd267edf9bde00ae170c8cf7f03d27d3e509b9636ee08ed8865cfd14c9f1b5a79abbb23814b17c0e875858b5cf520278c2b5df646d31bfc9f90e3daab09fcd69b0c32075d9de4e100307cf5528457ff9dd3cdc3765dcae26752f05190d458ee730adee316110193664da192cc9e3dd5895c793808769d59b734d1e2334df7536787843b28d46a92c28ec6736c8ef9ae1c6518474fdd791eb6bc0f3c35b62da01fc432e8818fb6b05b101bf79f5a1a48300c983e4bc565664bc453cc0d835709fb9e4b5bd23105a3cc91372986546198eeaa8ffe4c62e6dd7ee30b614962ce8817f5f51c8de4d47d77389a4d45cb2af8718681f8525f807aaf7ef096adde608a242a0642887d5e02577f81aabce53cc90c3226c182d46ff2cc2972c128f218579272116ce2fcb2aaf089d2b56329d03e27ae6ed7b3d93bf04ba92739dab03b1230ca55e085407386558cb2d4e5e5c8e0bda0d839024fbfafd5e1810a6fb43defea11b8a43fe4a89dec354e035ed883e88e36ee16918a423f380e22e9a463752091eeab49b4eff3ebf89e1dd3eaef9e99c9d297f54bb0dee831621a9a13e386e8328feb05c485a834927a476a9ad6ce6e0f0e032fa01dcd0241bebf1437a87d87225fd36149c111fd02f30823d680a12f8427c07d6074f57d80c0a7c9005fa2f5f2ea19f3a819ba3c1aecc25fde6dc3991e82ffc060e429c66868c2af3f6b66a79246e9792c06b649520cee00936ad7ae0a0072f6219516d72e268fbe3353321e95589201ec3b53a0d1518e81c0c9c69ad284fb2dd7fbc62e205b70151e3a32ebb15264ade903d695e96e036f67176c4a3dadebbf4acb6b8f5e69549d87252ec8b2258ed1f7e25aa0209eb0010e41327c3f85a8ef9248d23002bb069aa37933fc9449597062a94a2bb5bd997fdfc48a014cefe5f21cd0ec937bdb78c9dde6c53aa6fcdaf4923091df19ae576d1f6be324bc005362628e68108682ccd73ff3c54278eef21941a2b03450e3508bb2747d06e49b97dcd8e71ac931d3d53b71cdd408b60962e951ca06b70b46341457fa0dbf5a0a3269d1223870f92929f7150b0de25d516b8150169584d7845f610a59b497b42a85353e926c010ea6d8fc84eb74d34d555c44282738e369664f151294ec21c82456df64d319d183dcb2d8e48e52de8fc8a08812ab783d67baa8b6e04832a471324bb60d697e8613d904b04ec8a2917543f0743ca8cdc30fdf131183c3ee3afad9e611a566d427ca925fd9f32698c4ee51f28aec45f3c2b9d47169c373b85aab02200d499d9995d4dcf7742f1ad6bacba1d06b338f5742202eb05eaea5c682db7e35dc4351df66c09ab8c6225c5ace3575a593460a2b5445d5862ab0c2db5378660484a384e2e84272ccf5ee27950ff58fe44ccccbd213674fa6c02b0f679edb4dfeae9930b3381a26e148f8dee3404e4610f6ef7a56caea4094c4cee37a1df161800b9e1e19d6439698970a88e1d6f6888ccef6508f6ef416caae7d251af8fa0dd2bcb91da4b8a4102f5074b589df0ce218fff81e0f33be453c9145a72870608f88006d3b72e1a6296ae72247f0c5eb5bac77bcc4b3d09202da981b2676ac92e73911095380fce99e9e4664b6e284938cdbd34df806a67858141fa3bac06b48ea7fc985b274131d2aea8fa3f65f69ad0fb00a101f338204d74c5f8b9c651468b7611a369e1fb5ab74cb3783dc6d79a8694f2dbe9ef20005719cc60754d99a54dd6438db183b2e104b702aa4e3bf6f9cd1d6662deeaf97a6dcf2abb97929e2fedb82001cb95e4eeee01884a6f0490d9ab54190de2a0fcce6719400b3db02a041a1a97285578add4db617d4b79326f30ce37ac2ae4f5269b994224b0c888fc5718d6464b61119c041ca523b7c512dd1025df72487bfd5b0ffd825874a8274e4e93e4bea22308e085ce83d529d538a86c1cc11d91702c04966058b7541d6dea4f07090eb0928c6c1766bff5e848ff9c402ee2c61394237e96239b4b0db51d7aaa9e96c3fa666c98a822b30f9aef5984f33e9729175fef0dbcec6e1cbd8d69ad19cf8c6be738ea6475c09889b272e2eda57582b9dc304612f95bf864ffb721768528f7af49393c5bd92644b90eda019c8ec4668507ecedbf50381b5349d5c3e6a72bddf2004c68383749e5022c69034f583ce47b69073fc7e7c9f3ec7296d73248bd09185e2be91cf679f38b75d0eaa3715e634ef7db1acd0b2d4e1c79693e69e5910671e47903794dc86891173a297855556d9313088248110e88a7d4ae3f0091e000b90543bf7efd6e0211d652ec2c32bf9353a6478fb7949f1ac0c3617707ce742d8b0f730d803e0ff9c95fd22add52d7d3f873b9897bbd740197c839f88f3d1d5abe57fdefbdbfa918928666530e38cc2e9645db69988d0bfbc76a0d665f9dfbceae0cce8e0960539ad0313c89c862c486f8382265e384a36a1a3c19edbc1c1916a35f143004bcd3305ea05def6aaf42d62c7ed9a393d16a784ee4aad0b62b26b10ed03f2e2f820ed10592afdc5eb7a23c7ef3f3849885bc1fddcbe2ba49cace4e87e54af29a7f348d7c2a397e61c8edbfd5023d5be964104663f0c36a9fe157a1f1008b8dfbc1c22fe85aa560283703077950cf628de71ce32438a9c849560d857f6eb8fd71361296c316e94f08abe6091eabb6308de616be0d5f967ce0364d46cba92ef56492f60c563a05c0a7d5f620586ff49999297034aa81d8ce81e6292e2f5995459d8852a7b95cdb1708a50c9f933a5548efab41f18d4abda4a1a22d8ac0b95ecbff6700d1159c92b5c27c5f19502e28c31469b90aeefdaf26d8df6bd3379ac49e8d5a349942633ba62ddafeef3a377282c628481e4e13cdc88a094606c082eb625bc6847a032e4e3fd3e4c25fc86ecf3ceb1be01b9e92fc5ce61e340e13b7de580a691e35c250aed06fcf5d882ab82b6dfbf667998d334bbff39ab08cf91e3e99351fb8d9453df25fe95457dcb9ddee3aee23dd1569ce1e9c075414f507c5c907a9c7dc1f0f9d4bf910763a88ee76ae70e53b3a0f0969ee2b87b5a50e574a94d33707e99223ee4a49ee3ea99c4e96c3ebf081e10285cf686fa648dc7804c1637de76192114bd4bb5123e753cc3127dbed66ac010a8c679bdba8e8b5c594e6e9d4365dad53d7d026d9d761458131184916508e81c1a47713aa743699da18c32bb9012453826ab1287c79a0a35456e124304bf16bdc518c5bbae34b35bd37282720426f40eaa4a476dc015627dc5cabfc83ff57b25bd41094adcdcfb3605c96ecc89d3ea6c05ccb2cc4bfbaa53c36462dc1ecadd33871dc3e5aec88e5f0d74ee8201acf26c649db12b65f4660dd0bc2c1d26a9f97f7cdf00eb87b100556bce90c1dcced04e2a8199a7d43a99083e90b5a519d55e7b9daf25785c3eec4c26e397938e019c8a63942d85fe475658a0094a68e47574e4d92e748da2b35d09aacca24bfadb2b1d96d2b2f90a6a95055d8d423f164f444c649f5acf4a7216cc32aea155d237932c41165a694878ee1d4714b1777ba5d0baab37e5d171024a8013a500dadb9568ad80baa37cb707a56e23a0d6cc4d27168fe14438faa6292cec2adfc36b1b8aea925393c93546fffdac8f78c7106db9450de356259187e3ee0f895bb67ebfaf038c7f866d6571a2cd9138e756a0122464985cdfbe1f5942b8ddcd6fad4a", &(0x7f0000002280)=""/20, 0x9, 0x11, 0x1, &(0x7f00000022c0)}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000002440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002400)={&(0x7f0000002380)={0x48, 0x0, 0x100, 0x70bd2a, 0x0, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x64}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6a}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4048001}, 0x80) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) (async) 10:01:50 executing program 1: r0 = syz_io_uring_complete(0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f00000000c0)) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f0000000000)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0xde) 10:01:50 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async, rerun: 32) r1 = syz_io_uring_complete(r0) (rerun: 32) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r2, 0x8000000) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000400)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) getsockopt$llc_int(r1, 0x10c, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x1000000002, 0x2000) ioctl$SG_GET_NUM_WAITING(r3, 0x2270, &(0x7f0000000000)) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) (async) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), r5) 10:01:50 executing program 5: pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x2, {{0x80, 0x2, 0x3}, 0x80000001}}, 0x18) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000740)={0x0, 0xfffffffffffffffc, 0x3e, 0x1, @scatter={0x4, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000280)=""/206, 0xce}, {&(0x7f0000000380)=""/202, 0xca}, {&(0x7f0000000480)=""/83, 0x53}, {&(0x7f0000000500)=""/169, 0xa9}]}, &(0x7f0000000600)="89f4b9830b40b4f056116690ba5500abf7c52a50e02cf98eaee965eed83d9107c7e1490818bd443fc9a052033c7ed1fbc8c24de5829e728c655576dda77d", &(0x7f0000000640)=""/166, 0x1f, 0x20, 0xffffffffffffffff, &(0x7f0000000700)}) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r2 = syz_io_uring_complete(0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) (async) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000200)) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x54, 0x0, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x82}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xfffffffffffffff7}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'hsr0\x00'}, @L2TP_ATTR_DEBUG={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x20008806}, 0x4000) (async) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000007c0)={r2}, 0x8) setsockopt$SO_J1939_PROMISC(r3, 0x6b, 0x2, &(0x7f0000000800), 0x4) 10:01:50 executing program 1: r0 = syz_io_uring_complete(0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f00000000c0)) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f0000000000)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0xde) syz_io_uring_complete(0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f00000000c0)) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0xde) (async) 10:01:50 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) (async) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r2, 0x8000000) (async, rerun: 32) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f0000000400)) (rerun: 32) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) getsockopt$llc_int(r1, 0x10c, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x1000000002, 0x2000) ioctl$SG_GET_NUM_WAITING(r3, 0x2270, &(0x7f0000000000)) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) (async) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), r5) 10:01:50 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000080)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:50 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000002300)={0x0, 0xfffffffffffffffc, 0x1000, 0x3, @scatter={0x9, 0x0, &(0x7f0000000700)=[{&(0x7f0000000100)=""/118, 0x76}, {&(0x7f0000000180)=""/131, 0x83}, {&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/156, 0x9c}, {&(0x7f0000000400)=""/32, 0x20}, {&(0x7f0000002500)=""/4096, 0x1000}, {&(0x7f0000000440)=""/203, 0xcb}, {&(0x7f0000000540)=""/240, 0xf0}, {&(0x7f0000000640)=""/169, 0xa9}]}, &(0x7f0000001280)="22dfb82f22c15c0782704b4247fb24e7f37f41986909e5ba3d5662432850c1e14af50b65e4d9cea85f02eb54231976b547049cefc9678d13814523ac608c7e2d8d194d2b3cd423b04660c784263a0d9dc73f1e7a16afd757cd30217d7eb27f496de343037f32b3f71e73ad8a2a5a1a6644a59d9b964df5a784d3874dab4e8a9ecd7bb85543521569e9c396b4d5fa0a3620d020ceae1713f9c78375ca330a4791cccda20db5ed97c8a19650637f9831732bf3f990e23e9d9241adb06562d374db73c71eb47568a6c6591689218fedd63c20f875f6839f1992b3e3da1fcec9e3a75077a49009bee524fb63b59f423ca015d4f68fed8eaf58911da3839d3154fb585d05b92fdfa3780eea151d9888feb32dcd6c8873c9ae3a0390c4337f7ed84c5552896102630c67d3e9f390cd9687c8fa834baeb09c433165b5762a168260b19197d22b70518788797639274e76b6277decc6d4d88e972eb450c59867a9189aac3c421c544baa5928e1f16b02a5397ec491b510d4b029d8e18eddc3d788aae86e09e1f154ec384b87a8285408a133d9e6343bddda7dc5a4bf5976a674971666f138d7d6728eccba5f2939113fb0fdf156e07459069a97aac54753195b7fd186fcf1e3cd9cbea0d0c64f5bd0e19e34990b5d2b0df2ab949cb9ca82e55d4f708028be01ea015b33601bc843c8a2e005834caf6ed198aa054f7976b03dde3b83be711da5776d0cb9d7dcb9feb95eff51a15185d20e06fbe63adb1930c855b3f165d9adadfb2ca9895b236b439e2df9ad09212873ad1582c2db1f8e8da613bc6aa7ff2fb9db703e0879d56acb98e47889e2e1fd019ccb42cbdeac1777b8efccba604a5da5f5f69aea9eb0249b08df63ceff8d2b7dda855e3065977e43349452661ac8b99c1bf4ad7ed237e37932e6f0ff603073a5d0babc7a4bcdcccbd4b4952060670081671aaea075ea1f20fbccafa4b42e315651ec216523888f4ab690f130465f392378d8384d8fc839f4dd44b69a38cba18e7f64e9b3475499d7a87c3029d2668616815045c0fd857c6136bb5759a7a1f8dfd099186f2c289e3e0dfbac27965019527c878641cdf10fc714bc776df7e96416355aaba94c18896a631b32742c1519a487846fa1ac94f2a3525742892d86d123a47fccc21c0e0646626df6dd545998cc03b7d468e7d683432ce8505c807bf6bea66a1f97999779ee69c93973e240e6b6317c6ebadac9c1340f40ee80e82db6e518bfa5d4ee2f75571b86b8af2352178c7f3e91c5034f8b0f11cb1c1b619e14684cb837dfe488ad0d90b447a191f7039f15214244f3c206f41a4a6abc9d4d2dd459f6b2dd55c6b0b788a5e44950f0704dab9c977b8d0579fb4d5bc96ff4d71449f82802102e1da5fccb66ef9f0941ac92e26b9d353af07cede04aaf090f06a264f0ff16e98056fc22d5ced1be4bdf79ce525e66d2ce5661b07dbef89d7d77c57258161f300714452823948efe69e8cd32b2f4fb7b6f9c745a4b024fcb7f8a41269732180b5a7717d801a2c8c3b1ec87bc24ffb22cdde552cfe843737a2904c86a65aebc23e25e87c022676c0ece9d216e2bb224f7735395324d681bdac56712f4bd2c62a896f4fa8989c232545995dab112c14801f8597214851433c1d14bc5c4a202006de592dc3122cd35c31b9057efd98bc0b1b44e5346f2093e2a828ef9a06a58ed21f10b39bfe4e705cb07faf222cbf3e1508d7a61b897eb73e4d77c6d4ad309cdfc130c48ae8f9fc2e337ae73303ea5a7d4471296d7e3bc654fcf7ce77d4d9ee6e90207bb51a1756a107010870a7e9f9f8cd49f77f8ee847286ed7c36cabb74c48a5b5da118416eef3ffcb79b3d4b9163aef84009226dd92ec7c90a764c979ba743d009731dd77b2b223105a1c377dcf31691d7d84e9359fc6f64aacc57553c6edf547c2360cb956a0aca435744f1ebf08a15f1259b7d9ad563f833b356c9d75c700ffdbdf94e7fdc47f0df0c99792cce0f3d89974ce1cc4c60da2ab87e30de84640fffa0d4827bf2881b6a18c97b766be74369d6091a722ab53e124ffd5af9225a482d3dbc0f2b7d206a69452b1cd813c7ebb23f49ffd267edf9bde00ae170c8cf7f03d27d3e509b9636ee08ed8865cfd14c9f1b5a79abbb23814b17c0e875858b5cf520278c2b5df646d31bfc9f90e3daab09fcd69b0c32075d9de4e100307cf5528457ff9dd3cdc3765dcae26752f05190d458ee730adee316110193664da192cc9e3dd5895c793808769d59b734d1e2334df7536787843b28d46a92c28ec6736c8ef9ae1c6518474fdd791eb6bc0f3c35b62da01fc432e8818fb6b05b101bf79f5a1a48300c983e4bc565664bc453cc0d835709fb9e4b5bd23105a3cc91372986546198eeaa8ffe4c62e6dd7ee30b614962ce8817f5f51c8de4d47d77389a4d45cb2af8718681f8525f807aaf7ef096adde608a242a0642887d5e02577f81aabce53cc90c3226c182d46ff2cc2972c128f218579272116ce2fcb2aaf089d2b56329d03e27ae6ed7b3d93bf04ba92739dab03b1230ca55e085407386558cb2d4e5e5c8e0bda0d839024fbfafd5e1810a6fb43defea11b8a43fe4a89dec354e035ed883e88e36ee16918a423f380e22e9a463752091eeab49b4eff3ebf89e1dd3eaef9e99c9d297f54bb0dee831621a9a13e386e8328feb05c485a834927a476a9ad6ce6e0f0e032fa01dcd0241bebf1437a87d87225fd36149c111fd02f30823d680a12f8427c07d6074f57d80c0a7c9005fa2f5f2ea19f3a819ba3c1aecc25fde6dc3991e82ffc060e429c66868c2af3f6b66a79246e9792c06b649520cee00936ad7ae0a0072f6219516d72e268fbe3353321e95589201ec3b53a0d1518e81c0c9c69ad284fb2dd7fbc62e205b70151e3a32ebb15264ade903d695e96e036f67176c4a3dadebbf4acb6b8f5e69549d87252ec8b2258ed1f7e25aa0209eb0010e41327c3f85a8ef9248d23002bb069aa37933fc9449597062a94a2bb5bd997fdfc48a014cefe5f21cd0ec937bdb78c9dde6c53aa6fcdaf4923091df19ae576d1f6be324bc005362628e68108682ccd73ff3c54278eef21941a2b03450e3508bb2747d06e49b97dcd8e71ac931d3d53b71cdd408b60962e951ca06b70b46341457fa0dbf5a0a3269d1223870f92929f7150b0de25d516b8150169584d7845f610a59b497b42a85353e926c010ea6d8fc84eb74d34d555c44282738e369664f151294ec21c82456df64d319d183dcb2d8e48e52de8fc8a08812ab783d67baa8b6e04832a471324bb60d697e8613d904b04ec8a2917543f0743ca8cdc30fdf131183c3ee3afad9e611a566d427ca925fd9f32698c4ee51f28aec45f3c2b9d47169c373b85aab02200d499d9995d4dcf7742f1ad6bacba1d06b338f5742202eb05eaea5c682db7e35dc4351df66c09ab8c6225c5ace3575a593460a2b5445d5862ab0c2db5378660484a384e2e84272ccf5ee27950ff58fe44ccccbd213674fa6c02b0f679edb4dfeae9930b3381a26e148f8dee3404e4610f6ef7a56caea4094c4cee37a1df161800b9e1e19d6439698970a88e1d6f6888ccef6508f6ef416caae7d251af8fa0dd2bcb91da4b8a4102f5074b589df0ce218fff81e0f33be453c9145a72870608f88006d3b72e1a6296ae72247f0c5eb5bac77bcc4b3d09202da981b2676ac92e73911095380fce99e9e4664b6e284938cdbd34df806a67858141fa3bac06b48ea7fc985b274131d2aea8fa3f65f69ad0fb00a101f338204d74c5f8b9c651468b7611a369e1fb5ab74cb3783dc6d79a8694f2dbe9ef20005719cc60754d99a54dd6438db183b2e104b702aa4e3bf6f9cd1d6662deeaf97a6dcf2abb97929e2fedb82001cb95e4eeee01884a6f0490d9ab54190de2a0fcce6719400b3db02a041a1a97285578add4db617d4b79326f30ce37ac2ae4f5269b994224b0c888fc5718d6464b61119c041ca523b7c512dd1025df72487bfd5b0ffd825874a8274e4e93e4bea22308e085ce83d529d538a86c1cc11d91702c04966058b7541d6dea4f07090eb0928c6c1766bff5e848ff9c402ee2c61394237e96239b4b0db51d7aaa9e96c3fa666c98a822b30f9aef5984f33e9729175fef0dbcec6e1cbd8d69ad19cf8c6be738ea6475c09889b272e2eda57582b9dc304612f95bf864ffb721768528f7af49393c5bd92644b90eda019c8ec4668507ecedbf50381b5349d5c3e6a72bddf2004c68383749e5022c69034f583ce47b69073fc7e7c9f3ec7296d73248bd09185e2be91cf679f38b75d0eaa3715e634ef7db1acd0b2d4e1c79693e69e5910671e47903794dc86891173a297855556d9313088248110e88a7d4ae3f0091e000b90543bf7efd6e0211d652ec2c32bf9353a6478fb7949f1ac0c3617707ce742d8b0f730d803e0ff9c95fd22add52d7d3f873b9897bbd740197c839f88f3d1d5abe57fdefbdbfa918928666530e38cc2e9645db69988d0bfbc76a0d665f9dfbceae0cce8e0960539ad0313c89c862c486f8382265e384a36a1a3c19edbc1c1916a35f143004bcd3305ea05def6aaf42d62c7ed9a393d16a784ee4aad0b62b26b10ed03f2e2f820ed10592afdc5eb7a23c7ef3f3849885bc1fddcbe2ba49cace4e87e54af29a7f348d7c2a397e61c8edbfd5023d5be964104663f0c36a9fe157a1f1008b8dfbc1c22fe85aa560283703077950cf628de71ce32438a9c849560d857f6eb8fd71361296c316e94f08abe6091eabb6308de616be0d5f967ce0364d46cba92ef56492f60c563a05c0a7d5f620586ff49999297034aa81d8ce81e6292e2f5995459d8852a7b95cdb1708a50c9f933a5548efab41f18d4abda4a1a22d8ac0b95ecbff6700d1159c92b5c27c5f19502e28c31469b90aeefdaf26d8df6bd3379ac49e8d5a349942633ba62ddafeef3a377282c628481e4e13cdc88a094606c082eb625bc6847a032e4e3fd3e4c25fc86ecf3ceb1be01b9e92fc5ce61e340e13b7de580a691e35c250aed06fcf5d882ab82b6dfbf667998d334bbff39ab08cf91e3e99351fb8d9453df25fe95457dcb9ddee3aee23dd1569ce1e9c075414f507c5c907a9c7dc1f0f9d4bf910763a88ee76ae70e53b3a0f0969ee2b87b5a50e574a94d33707e99223ee4a49ee3ea99c4e96c3ebf081e10285cf686fa648dc7804c1637de76192114bd4bb5123e753cc3127dbed66ac010a8c679bdba8e8b5c594e6e9d4365dad53d7d026d9d761458131184916508e81c1a47713aa743699da18c32bb9012453826ab1287c79a0a35456e124304bf16bdc518c5bbae34b35bd37282720426f40eaa4a476dc015627dc5cabfc83ff57b25bd41094adcdcfb3605c96ecc89d3ea6c05ccb2cc4bfbaa53c36462dc1ecadd33871dc3e5aec88e5f0d74ee8201acf26c649db12b65f4660dd0bc2c1d26a9f97f7cdf00eb87b100556bce90c1dcced04e2a8199a7d43a99083e90b5a519d55e7b9daf25785c3eec4c26e397938e019c8a63942d85fe475658a0094a68e47574e4d92e748da2b35d09aacca24bfadb2b1d96d2b2f90a6a95055d8d423f164f444c649f5acf4a7216cc32aea155d237932c41165a694878ee1d4714b1777ba5d0baab37e5d171024a8013a500dadb9568ad80baa37cb707a56e23a0d6cc4d27168fe14438faa6292cec2adfc36b1b8aea925393c93546fffdac8f78c7106db9450de356259187e3ee0f895bb67ebfaf038c7f866d6571a2cd9138e756a0122464985cdfbe1f5942b8ddcd6fad4a", &(0x7f0000002280)=""/20, 0x9, 0x11, 0x1, &(0x7f00000022c0)}) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000002440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002400)={&(0x7f0000002380)={0x48, 0x0, 0x100, 0x70bd2a, 0x0, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x64}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6a}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4048001}, 0x80) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) (async) ioctl$SG_IO(r0, 0x2285, &(0x7f0000002300)={0x0, 0xfffffffffffffffc, 0x1000, 0x3, @scatter={0x9, 0x0, &(0x7f0000000700)=[{&(0x7f0000000100)=""/118, 0x76}, {&(0x7f0000000180)=""/131, 0x83}, {&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/156, 0x9c}, {&(0x7f0000000400)=""/32, 0x20}, {&(0x7f0000002500)=""/4096, 0x1000}, {&(0x7f0000000440)=""/203, 0xcb}, {&(0x7f0000000540)=""/240, 0xf0}, {&(0x7f0000000640)=""/169, 0xa9}]}, &(0x7f0000001280)="22dfb82f22c15c0782704b4247fb24e7f37f41986909e5ba3d5662432850c1e14af50b65e4d9cea85f02eb54231976b547049cefc9678d13814523ac608c7e2d8d194d2b3cd423b04660c784263a0d9dc73f1e7a16afd757cd30217d7eb27f496de343037f32b3f71e73ad8a2a5a1a6644a59d9b964df5a784d3874dab4e8a9ecd7bb85543521569e9c396b4d5fa0a3620d020ceae1713f9c78375ca330a4791cccda20db5ed97c8a19650637f9831732bf3f990e23e9d9241adb06562d374db73c71eb47568a6c6591689218fedd63c20f875f6839f1992b3e3da1fcec9e3a75077a49009bee524fb63b59f423ca015d4f68fed8eaf58911da3839d3154fb585d05b92fdfa3780eea151d9888feb32dcd6c8873c9ae3a0390c4337f7ed84c5552896102630c67d3e9f390cd9687c8fa834baeb09c433165b5762a168260b19197d22b70518788797639274e76b6277decc6d4d88e972eb450c59867a9189aac3c421c544baa5928e1f16b02a5397ec491b510d4b029d8e18eddc3d788aae86e09e1f154ec384b87a8285408a133d9e6343bddda7dc5a4bf5976a674971666f138d7d6728eccba5f2939113fb0fdf156e07459069a97aac54753195b7fd186fcf1e3cd9cbea0d0c64f5bd0e19e34990b5d2b0df2ab949cb9ca82e55d4f708028be01ea015b33601bc843c8a2e005834caf6ed198aa054f7976b03dde3b83be711da5776d0cb9d7dcb9feb95eff51a15185d20e06fbe63adb1930c855b3f165d9adadfb2ca9895b236b439e2df9ad09212873ad1582c2db1f8e8da613bc6aa7ff2fb9db703e0879d56acb98e47889e2e1fd019ccb42cbdeac1777b8efccba604a5da5f5f69aea9eb0249b08df63ceff8d2b7dda855e3065977e43349452661ac8b99c1bf4ad7ed237e37932e6f0ff603073a5d0babc7a4bcdcccbd4b4952060670081671aaea075ea1f20fbccafa4b42e315651ec216523888f4ab690f130465f392378d8384d8fc839f4dd44b69a38cba18e7f64e9b3475499d7a87c3029d2668616815045c0fd857c6136bb5759a7a1f8dfd099186f2c289e3e0dfbac27965019527c878641cdf10fc714bc776df7e96416355aaba94c18896a631b32742c1519a487846fa1ac94f2a3525742892d86d123a47fccc21c0e0646626df6dd545998cc03b7d468e7d683432ce8505c807bf6bea66a1f97999779ee69c93973e240e6b6317c6ebadac9c1340f40ee80e82db6e518bfa5d4ee2f75571b86b8af2352178c7f3e91c5034f8b0f11cb1c1b619e14684cb837dfe488ad0d90b447a191f7039f15214244f3c206f41a4a6abc9d4d2dd459f6b2dd55c6b0b788a5e44950f0704dab9c977b8d0579fb4d5bc96ff4d71449f82802102e1da5fccb66ef9f0941ac92e26b9d353af07cede04aaf090f06a264f0ff16e98056fc22d5ced1be4bdf79ce525e66d2ce5661b07dbef89d7d77c57258161f300714452823948efe69e8cd32b2f4fb7b6f9c745a4b024fcb7f8a41269732180b5a7717d801a2c8c3b1ec87bc24ffb22cdde552cfe843737a2904c86a65aebc23e25e87c022676c0ece9d216e2bb224f7735395324d681bdac56712f4bd2c62a896f4fa8989c232545995dab112c14801f8597214851433c1d14bc5c4a202006de592dc3122cd35c31b9057efd98bc0b1b44e5346f2093e2a828ef9a06a58ed21f10b39bfe4e705cb07faf222cbf3e1508d7a61b897eb73e4d77c6d4ad309cdfc130c48ae8f9fc2e337ae73303ea5a7d4471296d7e3bc654fcf7ce77d4d9ee6e90207bb51a1756a107010870a7e9f9f8cd49f77f8ee847286ed7c36cabb74c48a5b5da118416eef3ffcb79b3d4b9163aef84009226dd92ec7c90a764c979ba743d009731dd77b2b223105a1c377dcf31691d7d84e9359fc6f64aacc57553c6edf547c2360cb956a0aca435744f1ebf08a15f1259b7d9ad563f833b356c9d75c700ffdbdf94e7fdc47f0df0c99792cce0f3d89974ce1cc4c60da2ab87e30de84640fffa0d4827bf2881b6a18c97b766be74369d6091a722ab53e124ffd5af9225a482d3dbc0f2b7d206a69452b1cd813c7ebb23f49ffd267edf9bde00ae170c8cf7f03d27d3e509b9636ee08ed8865cfd14c9f1b5a79abbb23814b17c0e875858b5cf520278c2b5df646d31bfc9f90e3daab09fcd69b0c32075d9de4e100307cf5528457ff9dd3cdc3765dcae26752f05190d458ee730adee316110193664da192cc9e3dd5895c793808769d59b734d1e2334df7536787843b28d46a92c28ec6736c8ef9ae1c6518474fdd791eb6bc0f3c35b62da01fc432e8818fb6b05b101bf79f5a1a48300c983e4bc565664bc453cc0d835709fb9e4b5bd23105a3cc91372986546198eeaa8ffe4c62e6dd7ee30b614962ce8817f5f51c8de4d47d77389a4d45cb2af8718681f8525f807aaf7ef096adde608a242a0642887d5e02577f81aabce53cc90c3226c182d46ff2cc2972c128f218579272116ce2fcb2aaf089d2b56329d03e27ae6ed7b3d93bf04ba92739dab03b1230ca55e085407386558cb2d4e5e5c8e0bda0d839024fbfafd5e1810a6fb43defea11b8a43fe4a89dec354e035ed883e88e36ee16918a423f380e22e9a463752091eeab49b4eff3ebf89e1dd3eaef9e99c9d297f54bb0dee831621a9a13e386e8328feb05c485a834927a476a9ad6ce6e0f0e032fa01dcd0241bebf1437a87d87225fd36149c111fd02f30823d680a12f8427c07d6074f57d80c0a7c9005fa2f5f2ea19f3a819ba3c1aecc25fde6dc3991e82ffc060e429c66868c2af3f6b66a79246e9792c06b649520cee00936ad7ae0a0072f6219516d72e268fbe3353321e95589201ec3b53a0d1518e81c0c9c69ad284fb2dd7fbc62e205b70151e3a32ebb15264ade903d695e96e036f67176c4a3dadebbf4acb6b8f5e69549d87252ec8b2258ed1f7e25aa0209eb0010e41327c3f85a8ef9248d23002bb069aa37933fc9449597062a94a2bb5bd997fdfc48a014cefe5f21cd0ec937bdb78c9dde6c53aa6fcdaf4923091df19ae576d1f6be324bc005362628e68108682ccd73ff3c54278eef21941a2b03450e3508bb2747d06e49b97dcd8e71ac931d3d53b71cdd408b60962e951ca06b70b46341457fa0dbf5a0a3269d1223870f92929f7150b0de25d516b8150169584d7845f610a59b497b42a85353e926c010ea6d8fc84eb74d34d555c44282738e369664f151294ec21c82456df64d319d183dcb2d8e48e52de8fc8a08812ab783d67baa8b6e04832a471324bb60d697e8613d904b04ec8a2917543f0743ca8cdc30fdf131183c3ee3afad9e611a566d427ca925fd9f32698c4ee51f28aec45f3c2b9d47169c373b85aab02200d499d9995d4dcf7742f1ad6bacba1d06b338f5742202eb05eaea5c682db7e35dc4351df66c09ab8c6225c5ace3575a593460a2b5445d5862ab0c2db5378660484a384e2e84272ccf5ee27950ff58fe44ccccbd213674fa6c02b0f679edb4dfeae9930b3381a26e148f8dee3404e4610f6ef7a56caea4094c4cee37a1df161800b9e1e19d6439698970a88e1d6f6888ccef6508f6ef416caae7d251af8fa0dd2bcb91da4b8a4102f5074b589df0ce218fff81e0f33be453c9145a72870608f88006d3b72e1a6296ae72247f0c5eb5bac77bcc4b3d09202da981b2676ac92e73911095380fce99e9e4664b6e284938cdbd34df806a67858141fa3bac06b48ea7fc985b274131d2aea8fa3f65f69ad0fb00a101f338204d74c5f8b9c651468b7611a369e1fb5ab74cb3783dc6d79a8694f2dbe9ef20005719cc60754d99a54dd6438db183b2e104b702aa4e3bf6f9cd1d6662deeaf97a6dcf2abb97929e2fedb82001cb95e4eeee01884a6f0490d9ab54190de2a0fcce6719400b3db02a041a1a97285578add4db617d4b79326f30ce37ac2ae4f5269b994224b0c888fc5718d6464b61119c041ca523b7c512dd1025df72487bfd5b0ffd825874a8274e4e93e4bea22308e085ce83d529d538a86c1cc11d91702c04966058b7541d6dea4f07090eb0928c6c1766bff5e848ff9c402ee2c61394237e96239b4b0db51d7aaa9e96c3fa666c98a822b30f9aef5984f33e9729175fef0dbcec6e1cbd8d69ad19cf8c6be738ea6475c09889b272e2eda57582b9dc304612f95bf864ffb721768528f7af49393c5bd92644b90eda019c8ec4668507ecedbf50381b5349d5c3e6a72bddf2004c68383749e5022c69034f583ce47b69073fc7e7c9f3ec7296d73248bd09185e2be91cf679f38b75d0eaa3715e634ef7db1acd0b2d4e1c79693e69e5910671e47903794dc86891173a297855556d9313088248110e88a7d4ae3f0091e000b90543bf7efd6e0211d652ec2c32bf9353a6478fb7949f1ac0c3617707ce742d8b0f730d803e0ff9c95fd22add52d7d3f873b9897bbd740197c839f88f3d1d5abe57fdefbdbfa918928666530e38cc2e9645db69988d0bfbc76a0d665f9dfbceae0cce8e0960539ad0313c89c862c486f8382265e384a36a1a3c19edbc1c1916a35f143004bcd3305ea05def6aaf42d62c7ed9a393d16a784ee4aad0b62b26b10ed03f2e2f820ed10592afdc5eb7a23c7ef3f3849885bc1fddcbe2ba49cace4e87e54af29a7f348d7c2a397e61c8edbfd5023d5be964104663f0c36a9fe157a1f1008b8dfbc1c22fe85aa560283703077950cf628de71ce32438a9c849560d857f6eb8fd71361296c316e94f08abe6091eabb6308de616be0d5f967ce0364d46cba92ef56492f60c563a05c0a7d5f620586ff49999297034aa81d8ce81e6292e2f5995459d8852a7b95cdb1708a50c9f933a5548efab41f18d4abda4a1a22d8ac0b95ecbff6700d1159c92b5c27c5f19502e28c31469b90aeefdaf26d8df6bd3379ac49e8d5a349942633ba62ddafeef3a377282c628481e4e13cdc88a094606c082eb625bc6847a032e4e3fd3e4c25fc86ecf3ceb1be01b9e92fc5ce61e340e13b7de580a691e35c250aed06fcf5d882ab82b6dfbf667998d334bbff39ab08cf91e3e99351fb8d9453df25fe95457dcb9ddee3aee23dd1569ce1e9c075414f507c5c907a9c7dc1f0f9d4bf910763a88ee76ae70e53b3a0f0969ee2b87b5a50e574a94d33707e99223ee4a49ee3ea99c4e96c3ebf081e10285cf686fa648dc7804c1637de76192114bd4bb5123e753cc3127dbed66ac010a8c679bdba8e8b5c594e6e9d4365dad53d7d026d9d761458131184916508e81c1a47713aa743699da18c32bb9012453826ab1287c79a0a35456e124304bf16bdc518c5bbae34b35bd37282720426f40eaa4a476dc015627dc5cabfc83ff57b25bd41094adcdcfb3605c96ecc89d3ea6c05ccb2cc4bfbaa53c36462dc1ecadd33871dc3e5aec88e5f0d74ee8201acf26c649db12b65f4660dd0bc2c1d26a9f97f7cdf00eb87b100556bce90c1dcced04e2a8199a7d43a99083e90b5a519d55e7b9daf25785c3eec4c26e397938e019c8a63942d85fe475658a0094a68e47574e4d92e748da2b35d09aacca24bfadb2b1d96d2b2f90a6a95055d8d423f164f444c649f5acf4a7216cc32aea155d237932c41165a694878ee1d4714b1777ba5d0baab37e5d171024a8013a500dadb9568ad80baa37cb707a56e23a0d6cc4d27168fe14438faa6292cec2adfc36b1b8aea925393c93546fffdac8f78c7106db9450de356259187e3ee0f895bb67ebfaf038c7f866d6571a2cd9138e756a0122464985cdfbe1f5942b8ddcd6fad4a", &(0x7f0000002280)=""/20, 0x9, 0x11, 0x1, &(0x7f00000022c0)}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000002440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002400)={&(0x7f0000002380)={0x48, 0x0, 0x100, 0x70bd2a, 0x0, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x64}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6a}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4048001}, 0x80) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) (async) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000740)={0x0, 0xfffffffffffffffc, 0x3e, 0x1, @scatter={0x4, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000280)=""/206, 0xce}, {&(0x7f0000000380)=""/202, 0xca}, {&(0x7f0000000480)=""/83, 0x53}, {&(0x7f0000000500)=""/169, 0xa9}]}, &(0x7f0000000600)="89f4b9830b40b4f056116690ba5500abf7c52a50e02cf98eaee965eed83d9107c7e1490818bd443fc9a052033c7ed1fbc8c24de5829e728c655576dda77d", &(0x7f0000000640)=""/166, 0x1f, 0x20, 0xffffffffffffffff, &(0x7f0000000700)}) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r2 = syz_io_uring_complete(0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) (async) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000200)) (async) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x54, 0x0, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x82}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xfffffffffffffff7}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'hsr0\x00'}, @L2TP_ATTR_DEBUG={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x20008806}, 0x4000) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000007c0)={r2}, 0x8) setsockopt$SO_J1939_PROMISC(r3, 0x6b, 0x2, &(0x7f0000000800), 0x4) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) 10:01:50 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="16002f62730000000000000008"], 0x87ffff2) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="16002f62730000000000000008"], 0x87ffff2) (async) 10:01:50 executing program 1: r0 = syz_io_uring_complete(0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f00000000c0)) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f0000000000)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0xde) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0x10d682) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x41) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x363) 10:01:50 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000080)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000080)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) (async) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) 10:01:50 executing program 4: r0 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xffffffff, 0x2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r0, 0x8000000) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)={0xffffffffffffffff}, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={0xffffffffffffffff, r1}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) io_uring_setup(0x3b51, &(0x7f0000000080)={0x0, 0x8aa3, 0x0, 0x1, 0xcf, 0x0, r0}) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0xfffffffffffffee7, 0x33, 'vxcan1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r3}, 0x8) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xe, 0x4010, r0, 0x10000000) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x2270, &(0x7f0000000000)) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x24, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}, @GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1c}}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c094}, 0x84) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0x10d682) (async) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x41) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x363) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$inet(r2, &(0x7f0000001740)={&(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f00000015c0)=[{&(0x7f00000000c0)='{', 0x1}, {&(0x7f0000000400)="de3ca625656b832298951ee76d81c6ae1cc84e5a1eea6ff2d27b9ecb94a756a11d30e65b99a64e3d5e0ecb06092f79eead2e4727799d104edf5d239d00488ad7f043ac95e3cf2e3e8bf2e004ae2ec87c0624e9ec8049ab4a2fc3ef9e24172f1f722d4b598f1b9f9bed8f807376d2", 0x6e}, {&(0x7f0000000480)="99155efb9b9a1c54e6ece9f3402ea73edcab9be596bf37578a3dcee7f50a0f75e1d9dbd65a531da83f34831ef73372e207dcb1e101540e0f914474e934eb747d734279c13eb8f7c21e6a71b63a10f1a760881b069a07593fcc7bbbde5112b1df8c839bb6e028b64bdda732019629b09b5d8206007467e85e03641518200997441b31c768634b5ae9c4b4f918d857228c4083e1756b84af2a2ce1eaa8393080197a5fd8e4e45a466029bd7b160c7ff529057005dbf18a26dfc47d886364875b7454e2a9aec524f9464128f76aed3fce", 0xcf}, {&(0x7f0000000580)="8a65fce2d7333cc12591851a29c059fc433a93aa4b3960bcdad189967ec17b1b3c7f4f8cc300f2938a58470bb36755798cd4fa5a12aea83d66e946217e505f9ad8496cc1a927146df3803e7627af58b6449f743f7d8c82a274d1f6eeaf42eff99b3e2e99a2b96ae24f3287b7e35a932468ff2eb81a4b4111dc3f726ffbdb5db7e2ae4ba4314d8e0f83d17c77b93cc9682d28d2300af4fe6489b108891fa82a71c2ac198779a7f104f903c0802f3e600e4da4f3a35bd53eed1b9e2fd2c356b21cf9cfb938e0bb3485d1b3e55e56430d8cbdd5a2eeaaab00490770e9b1d85f368083b4a0eef0c205e2cfad0f42efb2110943202c545626809c7b07687e18d5e4f484a3d25b8709ac8163f284a382157e2535b7622bc5dcdf3e3dc675f3f966677e61aebeb642e15847295c9738b2470fd63a27ee415e3f9ebe2731afe828e44eb013332337b82179ae46956334ceac9787137659baa0074bb26d3b0b16666a5cee9914ceb2ca706c8651a29a72f4d32cdc7ae5e978c865a808066661a62a10a6ecb4839fc9a5aacbb487ae48853e94f0bcb27e4868f817397703c40024b596e7644ec3e70a889432cd4b7fbb18fe018205471dff362fb8db7523f1373263371a12f04ff801b3ed1ab3d7508aa45037982bdd3888b0faff26a53c0bc3d705b6cb299257dcfb2d7726bc2759829b9164e2d23664dd5739cd6937e365d7c0dd4c35170ab78715b3598b96b59c1000c23407ac5ce8ef2d444bbda69a3b49a730c299609aa03c1156f2bdcae676f7f50d73c63f63460804166b9ed45e35dc8c61b7b814b12bb1142123bc27218cb90a5d7dc6f75fd9571c7efa49711934d4315c96ca22ec105830eeddc87143f35634d7c0669f292dbe19ec2a2c4757da38193470ef695bc971ad78bbf932614e71150d7f8a33c1afddb1784de7319ecdcfc6d59e2fc8051f3ff2900d842df8413b27d30e4d2c03c20365960a36a69e426d6a5beefa1e4375b6a2ef9a9b2aa8aaa81a8df65b82111f07134cf4fef6f249bf857fadef7bda29ddb9fd890ea977b9827d14cf1ef9516588e6f02cdcaf6d30e2a244bbd5a57e4feb56fe2bd2633ba3e507ff3e5b82bbfd5be2ebf247a735e56ed4577451007b1520cfe879d18e5a7f9a9fea3d4e56353c8fe7bc563bc53ad028cf5444f449f40435f9c61b4e6d826e78cb3f73c1fb34de80073ba2bf382e8a0ad2e041714b9a3235df252b7bac639ed85647dbbbffda4f3b1e0dce1b0638b9e7509b3e3fc74de7e301fa457256a3ee12eb60444629904a0bcfec1779216410369af95b309e66e4e696d3f2fc2ec701029e736d25433e5fdae0f9dcbff2680357a2912ffce741d175cdd60290874939b5613e87ca74032ced7f0798a3a2910951d32b33e31006b1e9adbe18a986a43acefe1a6f69a1fa2291d5d13700116e78dd3714fc336dbc396f117b22fa272f2948e1a3c6c11dc27e851b0fdaa1f65572d6483e19504bd1b4ff0fcf05a51ef7c089be0befa02e3904c51bce0e1f0d9a1d57a056b666e1ae1238bd5ee313631ebd6bb93437162aadd25b6ec7305332d3592f5518748acbb3bbf43361c63974d43e8acc07e7edcd33895f792be2d215e8ad450819e03c56a016609110ca98017c2faef4c4617ea30d56ebfa6d9919d18c7f7b74a21959f755425f2df2a93e9bad1e1b9318c0528f77be0065901c6316629b335e353d9012539790c8bdc24d03e6bf382f62f7ce251400eb61f80349e8628252ead12df1263d74d9663a01cb04f0031f5e52b666a4bfe46261faa54a47547401a49d49386fc13a1522e35664f953a99fb0456128372fbf9f051bb2c9986a9c93a3cf9de50592792075b6aa0449a0fe8d633f9a9c626bd9c84c03cefc9767b745086cfa6b7a5816bdc3a4ddb896c71c9b6c6f75afb84636f929ea3a938093005fb07509dd947998285a9a99948ed6b8602e9473f746c90e9edf26a86d6e5a4313e24158e869e3545948f3fc712c95834d3046673771932ffd1de84c8fd3d1a5ff0338b8aa73a74350b215bc079c40044abbe763148dd6d54a9bd0b2e16c25b8f0fbd58a0bedc2ac9d25910cc9c7b43af27a3af03c6a618fb59d96d9c886bccd10d36da2bf1c0df701e6a76b59edd7756db32e185682704944c67eb4223015279e19ba8254cd89a67b3553f7d3114956137412c28d77ce9b1b0efea248cdfcab4b31e042496a08a58d7507ac3a13d220fdd22b9a12e83280f8280e594c9653f1d1b99723aaa21354868664ad54a1d236b66078d69c669deaec8ffaa5ee260fa454af68a3e26cf1b547754ce462c2a9dce1027736279f13ffb437343c90e901ac019f48e5bfc9fac91e6ee5cbc7652ee3021ed1e187216da86f2756120a0b4aed23a3e6ac49e584cbed5c00fbafae903d5e333b4fe2574503b117e369eedaf56f5a6330722fc849ca09ab610927b5abb085f8e3c3573f772126c8086321b175f9420c5b7647dc81c221c6682fda45b66ac2d435ec45cd73f9f26f7fc03ce56d53e90fcc870fabc4cf76376fbc4fcf4e31bab6d90d12cb8b8a0b0c52b70d36ad7cb548b1a2d5e00e5f63d9d14ca52e8c35daae29ae685d6af306857851959c95240acfff1dc0505d0ce73229d95e3c997350236ffec8698676b6812caef4a815d4db53aab0455da1b20ccfe55e9e41d0af559a1191da122c90bb6327157dcc5e3d80b1a05c3bb91834756ae1388630e78e104139e4482aa2c315223de2632f1d74eb6e193d5cdf382b6c14040ea9d228e559931896658f1c7df5d797947c43aef0edd33d18e45cf06d5d4cb177f8c493569defd627b8f8d7e8aa2f54cf7781f9bf92c650cb2d3b93d06919c57a90b734c22a887492e8da0c7fdf0912f802acebb56efb8cdf5fed10c3ab082b865c7ceab70ed173e015e6810e6b46e9512975883f2d9040e5fbd47828af9d181b7fc270a0f7ef39ee0d366fc3fdfab29ad261fc9c094850e8cb75556cdaadf0d23f6c1203d739e7569f3199a1d265e64c097463378c0ba6c3cb510f02ac097800c03eff2948ed16372714f9bcc00b712e2b9bec1ce035dc5afbe3b7b906c20f61294fed5c0fac4bb3446d3a105c83c32ecfda22b848a864e3875c7f28497acf91833665d3d46444b6a4f9c924ba66b9f335b8767c95c136fa02564564f341bcf956261f90f3640a64b8f75ca5a592894160f97195f5e5d496f0b3c1f55690fa1b35a665fbde64a8d7ed9ae402f8c02bd086daa458651035bd786ca6f9dce005c2a693e949e8aa4a6f37a5f0c2db8e711a6152eb451b3e44a2a85fb08abacc4f1106d5260d371053982472f59ef1b8013acdf4bcb3ac536680ca8ff9918a65298ce088ccbe713e3496b53f6e47db596e2db8acc0fc13a3c0f702640110d84222361c57a51eed6618b88f56db1b0effc186366dbbb471fa90eb1835735d959257175cb8d0c7ca0ae444b865d7be3f7f14a5febf73f72c0fc90c03a17a2243865c226b684d73dcb7a62c4d0ed336a97529c43a990a41277f148a1445abd6f39fc557350568cb17a753110c2ee700c71a5639c6b564a04194c0451ed02bd10f87cb0f72488881d62fca1dc19377d71793725e4b521a5169f7a205b625c65016fdced5a2aec0feeb7ea79a4c94ea9bd1737582055484d61d25c22ecc28124e0e8c0669def4a98934f166fd9b80475bb90e9cc7930094b9d387db80d3b8425fb8b73391f101b6e63c20e64e5ad70ed99a9c5d2c39cb3e3bb9fe1e9483c5021a4f07e0cba9a264cece8684d6dd83726c56c2934baca497d2ae2e4c138c087f8bb9261a4048a70db2a4abe89d2288f97057472c2a795955d90f1bf2afba0dd2b16c3051541110c24b301465693d9d434c872ad26696ce9fda7e827b727e5d107f3f2276e9023ac2522e3eb63c9e0d016ce265cdf0f321224801f4024ef4c4e7edc3d77c8088b311734c8d4705b358e18855d3b59ae99501d02a3a12517940bbc052e625f694b126efb5aeae46fe804981b7d0f0048d192b56c02279a9f192f9dddc8d6ccba825e5773b278a7a2628ceb8e098cd666350899f6f098756b05d759eebb42ad26df8fb731e7c5ec91bb7bb3b1fe487b96c965a1cf772dd5eba00d1ebbaa05f04c0221526e5046d55397488dea9c122411e95e87f0d12292d358e0d2d39a6d39a21d2b1cee202c6718681a67144ba61e734045ab9060a2bb32c1b1984d681d40cb34617c61744b1a8ef2955ae0ada5d0900d10dd6eff10b68cd3ead1b8ea961eebe3bed8d41973a0ac85a781e7e01a9ac56bdef344dbe29ce72116a96ff397c2aa8c3e8ec53e539bab4cc82276cd87c7a3ffcab3e8316994ba72d7b240eb2f620023708dd88d067605f4d7665367bab608f9ef24e6ec938c28caa573d217c27250af5e443fd133386d8d892c0f833c633810cc6260cfb6da84b51fadd3faca740afecd15fce392648ea27348c325e1276258749656bc18115efe208d238eeb92a682d94459a9e0d2af3a59ca25e2f22655944f9324ca832397e4cc3976aaf2a0135c81f1c71740fc4ad7de9c73cd66d669ab68c8556be829a29c9e15f28774b52e9eaea97d9ec59868a3bf4b42134ae0dd8f181d1c435d9346ef243a4b6eba607ac65a0db5d74c7e9eb3fab04dd22f50d93550e9cbc8dabc61248e531449941f153647093df355c4c566c82c2de2b64f684fe9df8074595f3c7867dee57be2c8e8b0248dc52e97fd7e8ea7a024fe1188cefa21187600342e5bd6fcdb688ac65ad9a51f0208c2406d6d08d1739a2ef6c1b472c3ee537ff62284abfc6559874b34fe6928012b4530121012cda4fb1f54691d5b0bcfc9ae18ba089a5e886735854a6274c77fe13190880963863bfa229f24743948355681347febcec827830cbfbcb8a3ebc3459d62258624c04a42f38158e51bf678f25f9cac022231bd57b67a8db5e9529aa01b5889e52e4040043b031b8e94307e109b74a13865b27ae5480386e30ed1767d5328b12a9f6d0ec66d82cc59c94e4aeed86a1fd78f96ce4aab1bc16df4424f09e83fe3148b9ba2aeca58175f6ae1d769e0be9896770f05844b238173c9bc4b53cb8ee841c1d3588c9b4c72d6099d837ce5e514c16960609acb0d0d6c8dc30531e9b0e0b3f368d4bb73159bc6b89863edfb6f378e83b2416731e1a15de301892cb70ba16f4cce7332d15eff34c92d003294d9fa84f7c51e901a71648c8dd8e45cc0241eaed000b1f021eb8e345199ae5c84cdb942bed76843bca4ffc3d28d781689b991fd74fad7aabf7fe7cd75164c830c77e6eaa5c2a4450d778c57a231f36c84c42b5e856af4e338eddce63a7fb946b83ca77805ab63deefcdb99e57e89a17f16e13eb923fe85de77e591b3291f640f076c0a5f6c8d3a9b90d9618dbcb05622fc4b4f7a62c0a9ba181756cc6bc97aaf211d28fb2a18e3a138f86b60e146f763f89174c55c24118cf2bf1008be6c89eb15ed5c765fc1eb736fbb7392017436ab96473c8cc19ae32ba1bd632bd678ece0ca6220542568d2e5f922ad20dc1d65733b024ae46bfd0242d7149e137c2820d76064819d72ba3ef15aa37bf5946f22eca8248793c97ea1ca193406ebda64ee480fe8ff5abab793cc67cc5335353a270ace23ac2142261873a8e596297c0e0f80cac4e3df9ea446ee5f46e50e5764191c32e87f9b84acdc3a96684d75371fb91854eccb5ad0dd22a68735041adaa60eae730360afe31a5966e1441e2d68d3f2b5c7159e2a3b9b2e50d94270cf6f5e793a3260ce566411bc73b11f2a21f54bd64fedbd6e7296", 0x1000}, {&(0x7f0000001580)="63f376ecf616cb2f37bf6f0d002a5c93", 0x10}], 0x5, &(0x7f0000001640)=[@ip_retopts={{0x9c, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0x24, 0x74, 0x3, 0x2, [{@loopback, 0x1000000}, {@private=0xa010101, 0xff}, {@loopback, 0x7}, {@multicast1, 0xf6e}]}, @rr={0x7, 0x3, 0xc9}, @timestamp_prespec={0x44, 0x3c, 0x3d, 0x3, 0x9, [{@remote, 0x8001}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x200}, {@empty, 0x416}, {@private=0xa010100, 0xfff}, {@rand_addr=0x64010100}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xff}, {@remote, 0x4}]}, @noop, @timestamp_addr={0x44, 0x24, 0x63, 0x1, 0x1, [{@multicast1, 0x8}, {@broadcast, 0x5}, {@loopback, 0x17}, {@local, 0x7}]}]}}}, @ip_retopts={{0x38, 0x0, 0x7, {[@end, @ssrr={0x89, 0x23, 0x39, [@remote, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010100, @broadcast, @local, @remote]}, @end]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xff}}], 0xf0}, 0x4000010) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:50 executing program 5: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000080)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:50 executing program 4: r0 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xffffffff, 0x2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r0, 0x8000000) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)={0xffffffffffffffff}, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={0xffffffffffffffff, r1}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) io_uring_setup(0x3b51, &(0x7f0000000080)={0x0, 0x8aa3, 0x0, 0x1, 0xcf, 0x0, r0}) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0xfffffffffffffee7, 0x33, 'vxcan1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r3}, 0x8) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xe, 0x4010, r0, 0x10000000) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x2270, &(0x7f0000000000)) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x24, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}, @GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1c}}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c094}, 0x84) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xffffffff, 0x2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r0, 0x8000000) (async) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)={0xffffffffffffffff}, 0x4) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={0xffffffffffffffff, r1}, 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async) io_uring_setup(0x3b51, &(0x7f0000000080)={0x0, 0x8aa3, 0x0, 0x1, 0xcf, 0x0, r0}) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0xfffffffffffffee7, 0x33, 'vxcan1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r3}, 0x8) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xe, 0x4010, r0, 0x10000000) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x2270, &(0x7f0000000000)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$GTP_CMD_DELPDP(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x24, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}, @GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1c}}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c094}, 0x84) (async) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0x10d682) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x41) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x363) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0x10d682) (async) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x41) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0x363) (async) 10:01:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = socket(0xf, 0x4, 0x1000) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@delchain={0x3c, 0x65, 0x20, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0x13}, {0x8, 0xffe0}, {0xfff1, 0x5}}, [@TCA_CHAIN={0x8, 0xb, 0x7}, @TCA_RATE={0x6, 0x5, {0x0, 0xe4}}, @TCA_CHAIN={0x8, 0xb, 0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f00000001c0)) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x20000, &(0x7f0000000100)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}, {@version_L}, {@privport}, {@cache_loose}], [{@appraise}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_type={'obj_type', 0x3d, '&'}}]}}) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$inet(r2, &(0x7f0000001740)={&(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f00000015c0)=[{&(0x7f00000000c0)='{', 0x1}, {&(0x7f0000000400)="de3ca625656b832298951ee76d81c6ae1cc84e5a1eea6ff2d27b9ecb94a756a11d30e65b99a64e3d5e0ecb06092f79eead2e4727799d104edf5d239d00488ad7f043ac95e3cf2e3e8bf2e004ae2ec87c0624e9ec8049ab4a2fc3ef9e24172f1f722d4b598f1b9f9bed8f807376d2", 0x6e}, {&(0x7f0000000480)="99155efb9b9a1c54e6ece9f3402ea73edcab9be596bf37578a3dcee7f50a0f75e1d9dbd65a531da83f34831ef73372e207dcb1e101540e0f914474e934eb747d734279c13eb8f7c21e6a71b63a10f1a760881b069a07593fcc7bbbde5112b1df8c839bb6e028b64bdda732019629b09b5d8206007467e85e03641518200997441b31c768634b5ae9c4b4f918d857228c4083e1756b84af2a2ce1eaa8393080197a5fd8e4e45a466029bd7b160c7ff529057005dbf18a26dfc47d886364875b7454e2a9aec524f9464128f76aed3fce", 0xcf}, {&(0x7f0000000580)="8a65fce2d7333cc12591851a29c059fc433a93aa4b3960bcdad189967ec17b1b3c7f4f8cc300f2938a58470bb36755798cd4fa5a12aea83d66e946217e505f9ad8496cc1a927146df3803e7627af58b6449f743f7d8c82a274d1f6eeaf42eff99b3e2e99a2b96ae24f3287b7e35a932468ff2eb81a4b4111dc3f726ffbdb5db7e2ae4ba4314d8e0f83d17c77b93cc9682d28d2300af4fe6489b108891fa82a71c2ac198779a7f104f903c0802f3e600e4da4f3a35bd53eed1b9e2fd2c356b21cf9cfb938e0bb3485d1b3e55e56430d8cbdd5a2eeaaab00490770e9b1d85f368083b4a0eef0c205e2cfad0f42efb2110943202c545626809c7b07687e18d5e4f484a3d25b8709ac8163f284a382157e2535b7622bc5dcdf3e3dc675f3f966677e61aebeb642e15847295c9738b2470fd63a27ee415e3f9ebe2731afe828e44eb013332337b82179ae46956334ceac9787137659baa0074bb26d3b0b16666a5cee9914ceb2ca706c8651a29a72f4d32cdc7ae5e978c865a808066661a62a10a6ecb4839fc9a5aacbb487ae48853e94f0bcb27e4868f817397703c40024b596e7644ec3e70a889432cd4b7fbb18fe018205471dff362fb8db7523f1373263371a12f04ff801b3ed1ab3d7508aa45037982bdd3888b0faff26a53c0bc3d705b6cb299257dcfb2d7726bc2759829b9164e2d23664dd5739cd6937e365d7c0dd4c35170ab78715b3598b96b59c1000c23407ac5ce8ef2d444bbda69a3b49a730c299609aa03c1156f2bdcae676f7f50d73c63f63460804166b9ed45e35dc8c61b7b814b12bb1142123bc27218cb90a5d7dc6f75fd9571c7efa49711934d4315c96ca22ec105830eeddc87143f35634d7c0669f292dbe19ec2a2c4757da38193470ef695bc971ad78bbf932614e71150d7f8a33c1afddb1784de7319ecdcfc6d59e2fc8051f3ff2900d842df8413b27d30e4d2c03c20365960a36a69e426d6a5beefa1e4375b6a2ef9a9b2aa8aaa81a8df65b82111f07134cf4fef6f249bf857fadef7bda29ddb9fd890ea977b9827d14cf1ef9516588e6f02cdcaf6d30e2a244bbd5a57e4feb56fe2bd2633ba3e507ff3e5b82bbfd5be2ebf247a735e56ed4577451007b1520cfe879d18e5a7f9a9fea3d4e56353c8fe7bc563bc53ad028cf5444f449f40435f9c61b4e6d826e78cb3f73c1fb34de80073ba2bf382e8a0ad2e041714b9a3235df252b7bac639ed85647dbbbffda4f3b1e0dce1b0638b9e7509b3e3fc74de7e301fa457256a3ee12eb60444629904a0bcfec1779216410369af95b309e66e4e696d3f2fc2ec701029e736d25433e5fdae0f9dcbff2680357a2912ffce741d175cdd60290874939b5613e87ca74032ced7f0798a3a2910951d32b33e31006b1e9adbe18a986a43acefe1a6f69a1fa2291d5d13700116e78dd3714fc336dbc396f117b22fa272f2948e1a3c6c11dc27e851b0fdaa1f65572d6483e19504bd1b4ff0fcf05a51ef7c089be0befa02e3904c51bce0e1f0d9a1d57a056b666e1ae1238bd5ee313631ebd6bb93437162aadd25b6ec7305332d3592f5518748acbb3bbf43361c63974d43e8acc07e7edcd33895f792be2d215e8ad450819e03c56a016609110ca98017c2faef4c4617ea30d56ebfa6d9919d18c7f7b74a21959f755425f2df2a93e9bad1e1b9318c0528f77be0065901c6316629b335e353d9012539790c8bdc24d03e6bf382f62f7ce251400eb61f80349e8628252ead12df1263d74d9663a01cb04f0031f5e52b666a4bfe46261faa54a47547401a49d49386fc13a1522e35664f953a99fb0456128372fbf9f051bb2c9986a9c93a3cf9de50592792075b6aa0449a0fe8d633f9a9c626bd9c84c03cefc9767b745086cfa6b7a5816bdc3a4ddb896c71c9b6c6f75afb84636f929ea3a938093005fb07509dd947998285a9a99948ed6b8602e9473f746c90e9edf26a86d6e5a4313e24158e869e3545948f3fc712c95834d3046673771932ffd1de84c8fd3d1a5ff0338b8aa73a74350b215bc079c40044abbe763148dd6d54a9bd0b2e16c25b8f0fbd58a0bedc2ac9d25910cc9c7b43af27a3af03c6a618fb59d96d9c886bccd10d36da2bf1c0df701e6a76b59edd7756db32e185682704944c67eb4223015279e19ba8254cd89a67b3553f7d3114956137412c28d77ce9b1b0efea248cdfcab4b31e042496a08a58d7507ac3a13d220fdd22b9a12e83280f8280e594c9653f1d1b99723aaa21354868664ad54a1d236b66078d69c669deaec8ffaa5ee260fa454af68a3e26cf1b547754ce462c2a9dce1027736279f13ffb437343c90e901ac019f48e5bfc9fac91e6ee5cbc7652ee3021ed1e187216da86f2756120a0b4aed23a3e6ac49e584cbed5c00fbafae903d5e333b4fe2574503b117e369eedaf56f5a6330722fc849ca09ab610927b5abb085f8e3c3573f772126c8086321b175f9420c5b7647dc81c221c6682fda45b66ac2d435ec45cd73f9f26f7fc03ce56d53e90fcc870fabc4cf76376fbc4fcf4e31bab6d90d12cb8b8a0b0c52b70d36ad7cb548b1a2d5e00e5f63d9d14ca52e8c35daae29ae685d6af306857851959c95240acfff1dc0505d0ce73229d95e3c997350236ffec8698676b6812caef4a815d4db53aab0455da1b20ccfe55e9e41d0af559a1191da122c90bb6327157dcc5e3d80b1a05c3bb91834756ae1388630e78e104139e4482aa2c315223de2632f1d74eb6e193d5cdf382b6c14040ea9d228e559931896658f1c7df5d797947c43aef0edd33d18e45cf06d5d4cb177f8c493569defd627b8f8d7e8aa2f54cf7781f9bf92c650cb2d3b93d06919c57a90b734c22a887492e8da0c7fdf0912f802acebb56efb8cdf5fed10c3ab082b865c7ceab70ed173e015e6810e6b46e9512975883f2d9040e5fbd47828af9d181b7fc270a0f7ef39ee0d366fc3fdfab29ad261fc9c094850e8cb75556cdaadf0d23f6c1203d739e7569f3199a1d265e64c097463378c0ba6c3cb510f02ac097800c03eff2948ed16372714f9bcc00b712e2b9bec1ce035dc5afbe3b7b906c20f61294fed5c0fac4bb3446d3a105c83c32ecfda22b848a864e3875c7f28497acf91833665d3d46444b6a4f9c924ba66b9f335b8767c95c136fa02564564f341bcf956261f90f3640a64b8f75ca5a592894160f97195f5e5d496f0b3c1f55690fa1b35a665fbde64a8d7ed9ae402f8c02bd086daa458651035bd786ca6f9dce005c2a693e949e8aa4a6f37a5f0c2db8e711a6152eb451b3e44a2a85fb08abacc4f1106d5260d371053982472f59ef1b8013acdf4bcb3ac536680ca8ff9918a65298ce088ccbe713e3496b53f6e47db596e2db8acc0fc13a3c0f702640110d84222361c57a51eed6618b88f56db1b0effc186366dbbb471fa90eb1835735d959257175cb8d0c7ca0ae444b865d7be3f7f14a5febf73f72c0fc90c03a17a2243865c226b684d73dcb7a62c4d0ed336a97529c43a990a41277f148a1445abd6f39fc557350568cb17a753110c2ee700c71a5639c6b564a04194c0451ed02bd10f87cb0f72488881d62fca1dc19377d71793725e4b521a5169f7a205b625c65016fdced5a2aec0feeb7ea79a4c94ea9bd1737582055484d61d25c22ecc28124e0e8c0669def4a98934f166fd9b80475bb90e9cc7930094b9d387db80d3b8425fb8b73391f101b6e63c20e64e5ad70ed99a9c5d2c39cb3e3bb9fe1e9483c5021a4f07e0cba9a264cece8684d6dd83726c56c2934baca497d2ae2e4c138c087f8bb9261a4048a70db2a4abe89d2288f97057472c2a795955d90f1bf2afba0dd2b16c3051541110c24b301465693d9d434c872ad26696ce9fda7e827b727e5d107f3f2276e9023ac2522e3eb63c9e0d016ce265cdf0f321224801f4024ef4c4e7edc3d77c8088b311734c8d4705b358e18855d3b59ae99501d02a3a12517940bbc052e625f694b126efb5aeae46fe804981b7d0f0048d192b56c02279a9f192f9dddc8d6ccba825e5773b278a7a2628ceb8e098cd666350899f6f098756b05d759eebb42ad26df8fb731e7c5ec91bb7bb3b1fe487b96c965a1cf772dd5eba00d1ebbaa05f04c0221526e5046d55397488dea9c122411e95e87f0d12292d358e0d2d39a6d39a21d2b1cee202c6718681a67144ba61e734045ab9060a2bb32c1b1984d681d40cb34617c61744b1a8ef2955ae0ada5d0900d10dd6eff10b68cd3ead1b8ea961eebe3bed8d41973a0ac85a781e7e01a9ac56bdef344dbe29ce72116a96ff397c2aa8c3e8ec53e539bab4cc82276cd87c7a3ffcab3e8316994ba72d7b240eb2f620023708dd88d067605f4d7665367bab608f9ef24e6ec938c28caa573d217c27250af5e443fd133386d8d892c0f833c633810cc6260cfb6da84b51fadd3faca740afecd15fce392648ea27348c325e1276258749656bc18115efe208d238eeb92a682d94459a9e0d2af3a59ca25e2f22655944f9324ca832397e4cc3976aaf2a0135c81f1c71740fc4ad7de9c73cd66d669ab68c8556be829a29c9e15f28774b52e9eaea97d9ec59868a3bf4b42134ae0dd8f181d1c435d9346ef243a4b6eba607ac65a0db5d74c7e9eb3fab04dd22f50d93550e9cbc8dabc61248e531449941f153647093df355c4c566c82c2de2b64f684fe9df8074595f3c7867dee57be2c8e8b0248dc52e97fd7e8ea7a024fe1188cefa21187600342e5bd6fcdb688ac65ad9a51f0208c2406d6d08d1739a2ef6c1b472c3ee537ff62284abfc6559874b34fe6928012b4530121012cda4fb1f54691d5b0bcfc9ae18ba089a5e886735854a6274c77fe13190880963863bfa229f24743948355681347febcec827830cbfbcb8a3ebc3459d62258624c04a42f38158e51bf678f25f9cac022231bd57b67a8db5e9529aa01b5889e52e4040043b031b8e94307e109b74a13865b27ae5480386e30ed1767d5328b12a9f6d0ec66d82cc59c94e4aeed86a1fd78f96ce4aab1bc16df4424f09e83fe3148b9ba2aeca58175f6ae1d769e0be9896770f05844b238173c9bc4b53cb8ee841c1d3588c9b4c72d6099d837ce5e514c16960609acb0d0d6c8dc30531e9b0e0b3f368d4bb73159bc6b89863edfb6f378e83b2416731e1a15de301892cb70ba16f4cce7332d15eff34c92d003294d9fa84f7c51e901a71648c8dd8e45cc0241eaed000b1f021eb8e345199ae5c84cdb942bed76843bca4ffc3d28d781689b991fd74fad7aabf7fe7cd75164c830c77e6eaa5c2a4450d778c57a231f36c84c42b5e856af4e338eddce63a7fb946b83ca77805ab63deefcdb99e57e89a17f16e13eb923fe85de77e591b3291f640f076c0a5f6c8d3a9b90d9618dbcb05622fc4b4f7a62c0a9ba181756cc6bc97aaf211d28fb2a18e3a138f86b60e146f763f89174c55c24118cf2bf1008be6c89eb15ed5c765fc1eb736fbb7392017436ab96473c8cc19ae32ba1bd632bd678ece0ca6220542568d2e5f922ad20dc1d65733b024ae46bfd0242d7149e137c2820d76064819d72ba3ef15aa37bf5946f22eca8248793c97ea1ca193406ebda64ee480fe8ff5abab793cc67cc5335353a270ace23ac2142261873a8e596297c0e0f80cac4e3df9ea446ee5f46e50e5764191c32e87f9b84acdc3a96684d75371fb91854eccb5ad0dd22a68735041adaa60eae730360afe31a5966e1441e2d68d3f2b5c7159e2a3b9b2e50d94270cf6f5e793a3260ce566411bc73b11f2a21f54bd64fedbd6e7296", 0x1000}, {&(0x7f0000001580)="63f376ecf616cb2f37bf6f0d002a5c93", 0x10}], 0x5, &(0x7f0000001640)=[@ip_retopts={{0x9c, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0x24, 0x74, 0x3, 0x2, [{@loopback, 0x1000000}, {@private=0xa010101, 0xff}, {@loopback, 0x7}, {@multicast1, 0xf6e}]}, @rr={0x7, 0x3, 0xc9}, @timestamp_prespec={0x44, 0x3c, 0x3d, 0x3, 0x9, [{@remote, 0x8001}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x200}, {@empty, 0x416}, {@private=0xa010100, 0xfff}, {@rand_addr=0x64010100}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xff}, {@remote, 0x4}]}, @noop, @timestamp_addr={0x44, 0x24, 0x63, 0x1, 0x1, [{@multicast1, 0x8}, {@broadcast, 0x5}, {@loopback, 0x17}, {@local, 0x7}]}]}}}, @ip_retopts={{0x38, 0x0, 0x7, {[@end, @ssrr={0x89, 0x23, 0x39, [@remote, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010100, @broadcast, @local, @remote]}, @end]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xff}}], 0xf0}, 0x4000010) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:50 executing program 4: r0 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xffffffff, 0x2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r0, 0x8000000) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)={0xffffffffffffffff}, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={0xffffffffffffffff, r1}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) io_uring_setup(0x3b51, &(0x7f0000000080)={0x0, 0x8aa3, 0x0, 0x1, 0xcf, 0x0, r0}) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0xfffffffffffffee7, 0x33, 'vxcan1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r3}, 0x8) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xe, 0x4010, r0, 0x10000000) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x2270, &(0x7f0000000000)) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x24, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}, @GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1c}}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c094}, 0x84) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xffffffff, 0x2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r0, 0x8000000) (async) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)={0xffffffffffffffff}, 0x4) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={0xffffffffffffffff, r1}, 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'vxcan1\x00'}) (async) io_uring_setup(0x3b51, &(0x7f0000000080)={0x0, 0x8aa3, 0x0, 0x1, 0xcf, 0x0, r0}) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0xfffffffffffffee7, 0x33, 'vxcan1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r3}, 0x8) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xe, 0x4010, r0, 0x10000000) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x2270, &(0x7f0000000000)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$GTP_CMD_DELPDP(r5, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x24, 0x0, 0x200, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}, @GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1c}}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c094}, 0x84) (async) 10:01:50 executing program 0: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x8, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'wg0\x00'}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x1000}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8040}, 0x40) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2203, &(0x7f0000000000)) 10:01:50 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) epoll_create(0x400) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r2, 0x1, 0x3f, 0x0, 0x0) r3 = syz_io_uring_complete(0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000380)={&(0x7f00000002c0), 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="0100000000000000000008000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_NOOP(r3, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r4, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback}]}, 0x30}, 0x1, 0x0, 0x0, 0x840}, 0x4008050) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcdf}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004010}, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600764000000000000000ff"], 0x87ffff2) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$inet(r2, &(0x7f0000001740)={&(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f00000015c0)=[{&(0x7f00000000c0)='{', 0x1}, {&(0x7f0000000400)="de3ca625656b832298951ee76d81c6ae1cc84e5a1eea6ff2d27b9ecb94a756a11d30e65b99a64e3d5e0ecb06092f79eead2e4727799d104edf5d239d00488ad7f043ac95e3cf2e3e8bf2e004ae2ec87c0624e9ec8049ab4a2fc3ef9e24172f1f722d4b598f1b9f9bed8f807376d2", 0x6e}, {&(0x7f0000000480)="99155efb9b9a1c54e6ece9f3402ea73edcab9be596bf37578a3dcee7f50a0f75e1d9dbd65a531da83f34831ef73372e207dcb1e101540e0f914474e934eb747d734279c13eb8f7c21e6a71b63a10f1a760881b069a07593fcc7bbbde5112b1df8c839bb6e028b64bdda732019629b09b5d8206007467e85e03641518200997441b31c768634b5ae9c4b4f918d857228c4083e1756b84af2a2ce1eaa8393080197a5fd8e4e45a466029bd7b160c7ff529057005dbf18a26dfc47d886364875b7454e2a9aec524f9464128f76aed3fce", 0xcf}, {&(0x7f0000000580)="8a65fce2d7333cc12591851a29c059fc433a93aa4b3960bcdad189967ec17b1b3c7f4f8cc300f2938a58470bb36755798cd4fa5a12aea83d66e946217e505f9ad8496cc1a927146df3803e7627af58b6449f743f7d8c82a274d1f6eeaf42eff99b3e2e99a2b96ae24f3287b7e35a932468ff2eb81a4b4111dc3f726ffbdb5db7e2ae4ba4314d8e0f83d17c77b93cc9682d28d2300af4fe6489b108891fa82a71c2ac198779a7f104f903c0802f3e600e4da4f3a35bd53eed1b9e2fd2c356b21cf9cfb938e0bb3485d1b3e55e56430d8cbdd5a2eeaaab00490770e9b1d85f368083b4a0eef0c205e2cfad0f42efb2110943202c545626809c7b07687e18d5e4f484a3d25b8709ac8163f284a382157e2535b7622bc5dcdf3e3dc675f3f966677e61aebeb642e15847295c9738b2470fd63a27ee415e3f9ebe2731afe828e44eb013332337b82179ae46956334ceac9787137659baa0074bb26d3b0b16666a5cee9914ceb2ca706c8651a29a72f4d32cdc7ae5e978c865a808066661a62a10a6ecb4839fc9a5aacbb487ae48853e94f0bcb27e4868f817397703c40024b596e7644ec3e70a889432cd4b7fbb18fe018205471dff362fb8db7523f1373263371a12f04ff801b3ed1ab3d7508aa45037982bdd3888b0faff26a53c0bc3d705b6cb299257dcfb2d7726bc2759829b9164e2d23664dd5739cd6937e365d7c0dd4c35170ab78715b3598b96b59c1000c23407ac5ce8ef2d444bbda69a3b49a730c299609aa03c1156f2bdcae676f7f50d73c63f63460804166b9ed45e35dc8c61b7b814b12bb1142123bc27218cb90a5d7dc6f75fd9571c7efa49711934d4315c96ca22ec105830eeddc87143f35634d7c0669f292dbe19ec2a2c4757da38193470ef695bc971ad78bbf932614e71150d7f8a33c1afddb1784de7319ecdcfc6d59e2fc8051f3ff2900d842df8413b27d30e4d2c03c20365960a36a69e426d6a5beefa1e4375b6a2ef9a9b2aa8aaa81a8df65b82111f07134cf4fef6f249bf857fadef7bda29ddb9fd890ea977b9827d14cf1ef9516588e6f02cdcaf6d30e2a244bbd5a57e4feb56fe2bd2633ba3e507ff3e5b82bbfd5be2ebf247a735e56ed4577451007b1520cfe879d18e5a7f9a9fea3d4e56353c8fe7bc563bc53ad028cf5444f449f40435f9c61b4e6d826e78cb3f73c1fb34de80073ba2bf382e8a0ad2e041714b9a3235df252b7bac639ed85647dbbbffda4f3b1e0dce1b0638b9e7509b3e3fc74de7e301fa457256a3ee12eb60444629904a0bcfec1779216410369af95b309e66e4e696d3f2fc2ec701029e736d25433e5fdae0f9dcbff2680357a2912ffce741d175cdd60290874939b5613e87ca74032ced7f0798a3a2910951d32b33e31006b1e9adbe18a986a43acefe1a6f69a1fa2291d5d13700116e78dd3714fc336dbc396f117b22fa272f2948e1a3c6c11dc27e851b0fdaa1f65572d6483e19504bd1b4ff0fcf05a51ef7c089be0befa02e3904c51bce0e1f0d9a1d57a056b666e1ae1238bd5ee313631ebd6bb93437162aadd25b6ec7305332d3592f5518748acbb3bbf43361c63974d43e8acc07e7edcd33895f792be2d215e8ad450819e03c56a016609110ca98017c2faef4c4617ea30d56ebfa6d9919d18c7f7b74a21959f755425f2df2a93e9bad1e1b9318c0528f77be0065901c6316629b335e353d9012539790c8bdc24d03e6bf382f62f7ce251400eb61f80349e8628252ead12df1263d74d9663a01cb04f0031f5e52b666a4bfe46261faa54a47547401a49d49386fc13a1522e35664f953a99fb0456128372fbf9f051bb2c9986a9c93a3cf9de50592792075b6aa0449a0fe8d633f9a9c626bd9c84c03cefc9767b745086cfa6b7a5816bdc3a4ddb896c71c9b6c6f75afb84636f929ea3a938093005fb07509dd947998285a9a99948ed6b8602e9473f746c90e9edf26a86d6e5a4313e24158e869e3545948f3fc712c95834d3046673771932ffd1de84c8fd3d1a5ff0338b8aa73a74350b215bc079c40044abbe763148dd6d54a9bd0b2e16c25b8f0fbd58a0bedc2ac9d25910cc9c7b43af27a3af03c6a618fb59d96d9c886bccd10d36da2bf1c0df701e6a76b59edd7756db32e185682704944c67eb4223015279e19ba8254cd89a67b3553f7d3114956137412c28d77ce9b1b0efea248cdfcab4b31e042496a08a58d7507ac3a13d220fdd22b9a12e83280f8280e594c9653f1d1b99723aaa21354868664ad54a1d236b66078d69c669deaec8ffaa5ee260fa454af68a3e26cf1b547754ce462c2a9dce1027736279f13ffb437343c90e901ac019f48e5bfc9fac91e6ee5cbc7652ee3021ed1e187216da86f2756120a0b4aed23a3e6ac49e584cbed5c00fbafae903d5e333b4fe2574503b117e369eedaf56f5a6330722fc849ca09ab610927b5abb085f8e3c3573f772126c8086321b175f9420c5b7647dc81c221c6682fda45b66ac2d435ec45cd73f9f26f7fc03ce56d53e90fcc870fabc4cf76376fbc4fcf4e31bab6d90d12cb8b8a0b0c52b70d36ad7cb548b1a2d5e00e5f63d9d14ca52e8c35daae29ae685d6af306857851959c95240acfff1dc0505d0ce73229d95e3c997350236ffec8698676b6812caef4a815d4db53aab0455da1b20ccfe55e9e41d0af559a1191da122c90bb6327157dcc5e3d80b1a05c3bb91834756ae1388630e78e104139e4482aa2c315223de2632f1d74eb6e193d5cdf382b6c14040ea9d228e559931896658f1c7df5d797947c43aef0edd33d18e45cf06d5d4cb177f8c493569defd627b8f8d7e8aa2f54cf7781f9bf92c650cb2d3b93d06919c57a90b734c22a887492e8da0c7fdf0912f802acebb56efb8cdf5fed10c3ab082b865c7ceab70ed173e015e6810e6b46e9512975883f2d9040e5fbd47828af9d181b7fc270a0f7ef39ee0d366fc3fdfab29ad261fc9c094850e8cb75556cdaadf0d23f6c1203d739e7569f3199a1d265e64c097463378c0ba6c3cb510f02ac097800c03eff2948ed16372714f9bcc00b712e2b9bec1ce035dc5afbe3b7b906c20f61294fed5c0fac4bb3446d3a105c83c32ecfda22b848a864e3875c7f28497acf91833665d3d46444b6a4f9c924ba66b9f335b8767c95c136fa02564564f341bcf956261f90f3640a64b8f75ca5a592894160f97195f5e5d496f0b3c1f55690fa1b35a665fbde64a8d7ed9ae402f8c02bd086daa458651035bd786ca6f9dce005c2a693e949e8aa4a6f37a5f0c2db8e711a6152eb451b3e44a2a85fb08abacc4f1106d5260d371053982472f59ef1b8013acdf4bcb3ac536680ca8ff9918a65298ce088ccbe713e3496b53f6e47db596e2db8acc0fc13a3c0f702640110d84222361c57a51eed6618b88f56db1b0effc186366dbbb471fa90eb1835735d959257175cb8d0c7ca0ae444b865d7be3f7f14a5febf73f72c0fc90c03a17a2243865c226b684d73dcb7a62c4d0ed336a97529c43a990a41277f148a1445abd6f39fc557350568cb17a753110c2ee700c71a5639c6b564a04194c0451ed02bd10f87cb0f72488881d62fca1dc19377d71793725e4b521a5169f7a205b625c65016fdced5a2aec0feeb7ea79a4c94ea9bd1737582055484d61d25c22ecc28124e0e8c0669def4a98934f166fd9b80475bb90e9cc7930094b9d387db80d3b8425fb8b73391f101b6e63c20e64e5ad70ed99a9c5d2c39cb3e3bb9fe1e9483c5021a4f07e0cba9a264cece8684d6dd83726c56c2934baca497d2ae2e4c138c087f8bb9261a4048a70db2a4abe89d2288f97057472c2a795955d90f1bf2afba0dd2b16c3051541110c24b301465693d9d434c872ad26696ce9fda7e827b727e5d107f3f2276e9023ac2522e3eb63c9e0d016ce265cdf0f321224801f4024ef4c4e7edc3d77c8088b311734c8d4705b358e18855d3b59ae99501d02a3a12517940bbc052e625f694b126efb5aeae46fe804981b7d0f0048d192b56c02279a9f192f9dddc8d6ccba825e5773b278a7a2628ceb8e098cd666350899f6f098756b05d759eebb42ad26df8fb731e7c5ec91bb7bb3b1fe487b96c965a1cf772dd5eba00d1ebbaa05f04c0221526e5046d55397488dea9c122411e95e87f0d12292d358e0d2d39a6d39a21d2b1cee202c6718681a67144ba61e734045ab9060a2bb32c1b1984d681d40cb34617c61744b1a8ef2955ae0ada5d0900d10dd6eff10b68cd3ead1b8ea961eebe3bed8d41973a0ac85a781e7e01a9ac56bdef344dbe29ce72116a96ff397c2aa8c3e8ec53e539bab4cc82276cd87c7a3ffcab3e8316994ba72d7b240eb2f620023708dd88d067605f4d7665367bab608f9ef24e6ec938c28caa573d217c27250af5e443fd133386d8d892c0f833c633810cc6260cfb6da84b51fadd3faca740afecd15fce392648ea27348c325e1276258749656bc18115efe208d238eeb92a682d94459a9e0d2af3a59ca25e2f22655944f9324ca832397e4cc3976aaf2a0135c81f1c71740fc4ad7de9c73cd66d669ab68c8556be829a29c9e15f28774b52e9eaea97d9ec59868a3bf4b42134ae0dd8f181d1c435d9346ef243a4b6eba607ac65a0db5d74c7e9eb3fab04dd22f50d93550e9cbc8dabc61248e531449941f153647093df355c4c566c82c2de2b64f684fe9df8074595f3c7867dee57be2c8e8b0248dc52e97fd7e8ea7a024fe1188cefa21187600342e5bd6fcdb688ac65ad9a51f0208c2406d6d08d1739a2ef6c1b472c3ee537ff62284abfc6559874b34fe6928012b4530121012cda4fb1f54691d5b0bcfc9ae18ba089a5e886735854a6274c77fe13190880963863bfa229f24743948355681347febcec827830cbfbcb8a3ebc3459d62258624c04a42f38158e51bf678f25f9cac022231bd57b67a8db5e9529aa01b5889e52e4040043b031b8e94307e109b74a13865b27ae5480386e30ed1767d5328b12a9f6d0ec66d82cc59c94e4aeed86a1fd78f96ce4aab1bc16df4424f09e83fe3148b9ba2aeca58175f6ae1d769e0be9896770f05844b238173c9bc4b53cb8ee841c1d3588c9b4c72d6099d837ce5e514c16960609acb0d0d6c8dc30531e9b0e0b3f368d4bb73159bc6b89863edfb6f378e83b2416731e1a15de301892cb70ba16f4cce7332d15eff34c92d003294d9fa84f7c51e901a71648c8dd8e45cc0241eaed000b1f021eb8e345199ae5c84cdb942bed76843bca4ffc3d28d781689b991fd74fad7aabf7fe7cd75164c830c77e6eaa5c2a4450d778c57a231f36c84c42b5e856af4e338eddce63a7fb946b83ca77805ab63deefcdb99e57e89a17f16e13eb923fe85de77e591b3291f640f076c0a5f6c8d3a9b90d9618dbcb05622fc4b4f7a62c0a9ba181756cc6bc97aaf211d28fb2a18e3a138f86b60e146f763f89174c55c24118cf2bf1008be6c89eb15ed5c765fc1eb736fbb7392017436ab96473c8cc19ae32ba1bd632bd678ece0ca6220542568d2e5f922ad20dc1d65733b024ae46bfd0242d7149e137c2820d76064819d72ba3ef15aa37bf5946f22eca8248793c97ea1ca193406ebda64ee480fe8ff5abab793cc67cc5335353a270ace23ac2142261873a8e596297c0e0f80cac4e3df9ea446ee5f46e50e5764191c32e87f9b84acdc3a96684d75371fb91854eccb5ad0dd22a68735041adaa60eae730360afe31a5966e1441e2d68d3f2b5c7159e2a3b9b2e50d94270cf6f5e793a3260ce566411bc73b11f2a21f54bd64fedbd6e7296", 0x1000}, {&(0x7f0000001580)="63f376ecf616cb2f37bf6f0d002a5c93", 0x10}], 0x5, &(0x7f0000001640)=[@ip_retopts={{0x9c, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0x24, 0x74, 0x3, 0x2, [{@loopback, 0x1000000}, {@private=0xa010101, 0xff}, {@loopback, 0x7}, {@multicast1, 0xf6e}]}, @rr={0x7, 0x3, 0xc9}, @timestamp_prespec={0x44, 0x3c, 0x3d, 0x3, 0x9, [{@remote, 0x8001}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x200}, {@empty, 0x416}, {@private=0xa010100, 0xfff}, {@rand_addr=0x64010100}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xff}, {@remote, 0x4}]}, @noop, @timestamp_addr={0x44, 0x24, 0x63, 0x1, 0x1, [{@multicast1, 0x8}, {@broadcast, 0x5}, {@loopback, 0x17}, {@local, 0x7}]}]}}}, @ip_retopts={{0x38, 0x0, 0x7, {[@end, @ssrr={0x89, 0x23, 0x39, [@remote, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010100, @broadcast, @local, @remote]}, @end]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xff}}], 0xf0}, 0x4000010) (async) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = socket(0xf, 0x4, 0x1000) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@delchain={0x3c, 0x65, 0x20, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0x13}, {0x8, 0xffe0}, {0xfff1, 0x5}}, [@TCA_CHAIN={0x8, 0xb, 0x7}, @TCA_RATE={0x6, 0x5, {0x0, 0xe4}}, @TCA_CHAIN={0x8, 0xb, 0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x95) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f00000001c0)) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x20000, &(0x7f0000000100)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}, {@version_L}, {@privport}, {@cache_loose}], [{@appraise}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_type={'obj_type', 0x3d, '&'}}]}}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f00000001c0)) (async) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x20000, &(0x7f0000000100)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}, {@version_L}, {@privport}, {@cache_loose}], [{@appraise}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_type={'obj_type', 0x3d, '&'}}]}}) (async) 10:01:50 executing program 0: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x8, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'wg0\x00'}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x1000}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8040}, 0x40) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2203, &(0x7f0000000000)) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) socket$isdn_base(0x22, 0x3, 0x0) getpeername$llc(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_complete(r1) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="a8000000000400000000000078fda3c44fafd6ef86396aa4d1df617a4b3ae182b2f7fe7e7f5f132543826e122214410afc3f92a8703ea924bb241a60fd941de12f138e2d131c6d9041a924037113637bef843b13337f791e31d8e120e71d46d45069267aa01f7d5344f6ffcf00cf311457ae7f5d36015aabcfa4174d5490095e933bd2a71dd0e82eb10b027c7a08eedbe6d3388eac4efef340222a8332c7286a3125215932767b8ac8"]) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f00000004c0)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'xfrm0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x40000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) 10:01:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = socket(0xf, 0x4, 0x1000) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@delchain={0x3c, 0x65, 0x20, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0x13}, {0x8, 0xffe0}, {0xfff1, 0x5}}, [@TCA_CHAIN={0x8, 0xb, 0x7}, @TCA_RATE={0x6, 0x5, {0x0, 0xe4}}, @TCA_CHAIN={0x8, 0xb, 0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) socket(0xf, 0x4, 0x1000) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@delchain={0x3c, 0x65, 0x20, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0x13}, {0x8, 0xffe0}, {0xfff1, 0x5}}, [@TCA_CHAIN={0x8, 0xb, 0x7}, @TCA_RATE={0x6, 0x5, {0x0, 0xe4}}, @TCA_CHAIN={0x8, 0xb, 0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:50 executing program 0: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x8, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'wg0\x00'}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x1000}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8040}, 0x40) (async) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2203, &(0x7f0000000000)) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f00000001c0)) (async) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x20000, &(0x7f0000000100)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}, {@version_L}, {@privport}, {@cache_loose}], [{@appraise}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_type={'obj_type', 0x3d, '&'}}]}}) 10:01:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x400) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000000c0)={0x40, 0x8, 0x8, "2cc7e4c28a1e9d82d7aea8f5d2b3cbcea25c33870b9fca799cd80e521820daef6b1f4954a14385262b57ab5a22fc0c0d010a64cc6e4928232bd5c7824a0a7b63"}) 10:01:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x95) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x95) (async) [ 3387.575103][T29998] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 10:01:50 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) epoll_create(0x400) (async, rerun: 32) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) (async, rerun: 32) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r2, 0x1, 0x3f, 0x0, 0x0) (async, rerun: 64) r3 = syz_io_uring_complete(0x0) (rerun: 64) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000380)={&(0x7f00000002c0), 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="0100000000000000000008000000"], 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_NOOP(r3, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r4, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback}]}, 0x30}, 0x1, 0x0, 0x0, 0x840}, 0x4008050) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcdf}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004010}, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600764000000000000000ff"], 0x87ffff2) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000400)=0x1) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a2a000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000100)=0x1f) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:50 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 10:01:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x400) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000000c0)={0x40, 0x8, 0x8, "2cc7e4c28a1e9d82d7aea8f5d2b3cbcea25c33870b9fca799cd80e521820daef6b1f4954a14385262b57ab5a22fc0c0d010a64cc6e4928232bd5c7824a0a7b63"}) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) socket$isdn_base(0x22, 0x3, 0x0) getpeername$llc(0xffffffffffffffff, 0x0, 0x0) (async) r2 = syz_io_uring_complete(r1) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="a8000000000400000000000078fda3c44fafd6ef86396aa4d1df617a4b3ae182b2f7fe7e7f5f132543826e122214410afc3f92a8703ea924bb241a60fd941de12f138e2d131c6d9041a924037113637bef843b13337f791e31d8e120e71d46d45069267aa01f7d5344f6ffcf00cf311457ae7f5d36015aabcfa4174d5490095e933bd2a71dd0e82eb10b027c7a08eedbe6d3388eac4efef340222a8332c7286a3125215932767b8ac8"]) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f00000004c0)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'xfrm0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x40000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) 10:01:50 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x95) 10:01:50 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 10:01:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x400) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async, rerun: 32) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000000c0)={0x40, 0x8, 0x8, "2cc7e4c28a1e9d82d7aea8f5d2b3cbcea25c33870b9fca799cd80e521820daef6b1f4954a14385262b57ab5a22fc0c0d010a64cc6e4928232bd5c7824a0a7b63"}) (rerun: 32) 10:01:50 executing program 4: ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x0, 0xd40f, 0x6, @dev={0xfe, 0x80, '\x00', 0x18}, @remote, 0x8, 0x8000, 0x7, 0x2ea}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'ip6_vti0\x00', r0, 0x2f, 0x3, 0x3, 0x8000, 0x40, @loopback, @ipv4={'\x00', '\xff\xff', @remote}, 0x40, 0x10, 0x6, 0x8000}}) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f00000004c0)={'ip6tnl0\x00', &(0x7f0000000440)={'syztnl0\x00', 0x0, 0x4, 0xff, 0x2, 0xfff, 0x3e, @mcast2, @local, 0x20, 0x20, 0x140000, 0x1}}) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000200)="5ef275de7d674addf1e962901374df916bb7d23915f762f4fa27f5fb1ac255ecca5d692093c08536667599dbdde1328830c69cab2dd0a7ae376465261cdf048308ec7e6068b67ffd42d1ccd07d87187453262a8bb93a1089691fdf86474c4225bd9879a6f4b175f2e75f2de413d3b57d9f7577e70a5ca3db537316f66d98ded5427407219c79637602d0187c629b2e3c815f151ec5769d359ccb462d08a5f095c10c71c0533bf51c9058823f2c2922ff", 0xb0}, {&(0x7f00000002c0)="4621626a353f0390952f67962b44a139013b9a98923d8930112c7a499fba338de84fc7da70de275702c1ef41df23b3853ce212945736be0558d13f5d997caed2b5973387141e0bf560dc3931b9463bc8c1284014af43c36ce4a9bd703f92f4c69784292ebc78543f445c994d10f1af232fe7569a81eee36d84759f345832a2c4539d8f2272db1423a11daa77906a8c872dedfe99beb2fc3c9427362f5dbe8ccdccec65e1671d0c9f6996d0cdca3ee6c11cdef2bcecd1b848bb1c0934d35e4f310ca1911381c422f115a3f55e6f56c84cd1ab69882bf8b771ef9f862911e7ad1ceace21c63622ea3b9379150bc628eac078", 0xf1}], 0x2}, 0x8841) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) 10:01:50 executing program 5: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x1000000, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@privport}], [{@hash}, {@fsname={'fsname', 0x3d, '/dev/sg#\x00'}}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/sg#\x00'}}, {@smackfshat={'smackfshat', 0x3d, '/dev/sg#\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x31, 0x32, 0x37, 0x34, 0x37, 0x62, 0x62, 0x64], 0x2d, [0x33, 0x38, 0x63, 0x64], 0x2d, [0x34, 0x63, 0x66, 0x38], 0x2d, [0x35, 0x35, 0x61, 0x32], 0x2d, [0x36, 0x61, 0x34, 0x34, 0x64, 0x35, 0x30, 0x52]}}}]}}) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x1267, &(0x7f0000000000)) 10:01:50 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) socket$isdn_base(0x22, 0x3, 0x0) getpeername$llc(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_complete(r1) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="a8000000000400000000000078fda3c44fafd6ef86396aa4d1df617a4b3ae182b2f7fe7e7f5f132543826e122214410afc3f92a8703ea924bb241a60fd941de12f138e2d131c6d9041a924037113637bef843b13337f791e31d8e120e71d46d45069267aa01f7d5344f6ffcf00cf311457ae7f5d36015aabcfa4174d5490095e933bd2a71dd0e82eb10b027c7a08eedbe6d3388eac4efef340222a8332c7286a3125215932767b8ac8"]) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f00000004c0)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'xfrm0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x40000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) 10:01:50 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) epoll_create(0x400) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) (async, rerun: 64) r2 = socket$pptp(0x18, 0x1, 0x2) (rerun: 64) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r2, 0x1, 0x3f, 0x0, 0x0) (async, rerun: 32) r3 = syz_io_uring_complete(0x0) (async, rerun: 32) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r5, &(0x7f0000000380)={&(0x7f00000002c0), 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="0100000000000000000008000000"], 0x14}}, 0x0) (async, rerun: 64) sendmsg$L2TP_CMD_NOOP(r3, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r4, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback}]}, 0x30}, 0x1, 0x0, 0x0, 0x840}, 0x4008050) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xcdf}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004010}, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600764000000000000000ff"], 0x87ffff2) 10:01:50 executing program 4: ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x0, 0xd40f, 0x6, @dev={0xfe, 0x80, '\x00', 0x18}, @remote, 0x8, 0x8000, 0x7, 0x2ea}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'ip6_vti0\x00', r0, 0x2f, 0x3, 0x3, 0x8000, 0x40, @loopback, @ipv4={'\x00', '\xff\xff', @remote}, 0x40, 0x10, 0x6, 0x8000}}) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f00000004c0)={'ip6tnl0\x00', &(0x7f0000000440)={'syztnl0\x00', 0x0, 0x4, 0xff, 0x2, 0xfff, 0x3e, @mcast2, @local, 0x20, 0x20, 0x140000, 0x1}}) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000200)="5ef275de7d674addf1e962901374df916bb7d23915f762f4fa27f5fb1ac255ecca5d692093c08536667599dbdde1328830c69cab2dd0a7ae376465261cdf048308ec7e6068b67ffd42d1ccd07d87187453262a8bb93a1089691fdf86474c4225bd9879a6f4b175f2e75f2de413d3b57d9f7577e70a5ca3db537316f66d98ded5427407219c79637602d0187c629b2e3c815f151ec5769d359ccb462d08a5f095c10c71c0533bf51c9058823f2c2922ff", 0xb0}, {&(0x7f00000002c0)="4621626a353f0390952f67962b44a139013b9a98923d8930112c7a499fba338de84fc7da70de275702c1ef41df23b3853ce212945736be0558d13f5d997caed2b5973387141e0bf560dc3931b9463bc8c1284014af43c36ce4a9bd703f92f4c69784292ebc78543f445c994d10f1af232fe7569a81eee36d84759f345832a2c4539d8f2272db1423a11daa77906a8c872dedfe99beb2fc3c9427362f5dbe8ccdccec65e1671d0c9f6996d0cdca3ee6c11cdef2bcecd1b848bb1c0934d35e4f310ca1911381c422f115a3f55e6f56c84cd1ab69882bf8b771ef9f862911e7ad1ceace21c63622ea3b9379150bc628eac078", 0xf1}], 0x2}, 0x8841) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) (async) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000400)=0x1) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a2a000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000100)=0x1f) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) [ 3387.698603][T30033] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 10:01:50 executing program 5: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x1000000, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@privport}], [{@hash}, {@fsname={'fsname', 0x3d, '/dev/sg#\x00'}}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/sg#\x00'}}, {@smackfshat={'smackfshat', 0x3d, '/dev/sg#\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x31, 0x32, 0x37, 0x34, 0x37, 0x62, 0x62, 0x64], 0x2d, [0x33, 0x38, 0x63, 0x64], 0x2d, [0x34, 0x63, 0x66, 0x38], 0x2d, [0x35, 0x35, 0x61, 0x32], 0x2d, [0x36, 0x61, 0x34, 0x34, 0x64, 0x35, 0x30, 0x52]}}}]}}) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x1267, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) socket$pptp(0x18, 0x1, 0x2) (async) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x1000000, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@privport}], [{@hash}, {@fsname={'fsname', 0x3d, '/dev/sg#\x00'}}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/sg#\x00'}}, {@smackfshat={'smackfshat', 0x3d, '/dev/sg#\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x31, 0x32, 0x37, 0x34, 0x37, 0x62, 0x62, 0x64], 0x2d, [0x33, 0x38, 0x63, 0x64], 0x2d, [0x34, 0x63, 0x66, 0x38], 0x2d, [0x35, 0x35, 0x61, 0x32], 0x2d, [0x36, 0x61, 0x34, 0x34, 0x64, 0x35, 0x30, 0x52]}}}]}}) (async) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r3, 0x1267, &(0x7f0000000000)) (async) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000400)) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000400)=0x1) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a2a000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000100)=0x1f) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) (async) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000080)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(0x0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000400)=0x1) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a2a000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000100)=0x1f) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f00000000c0)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x203) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:50 executing program 4: ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x0, 0xd40f, 0x6, @dev={0xfe, 0x80, '\x00', 0x18}, @remote, 0x8, 0x8000, 0x7, 0x2ea}}) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'ip6_vti0\x00', r0, 0x2f, 0x3, 0x3, 0x8000, 0x40, @loopback, @ipv4={'\x00', '\xff\xff', @remote}, 0x40, 0x10, 0x6, 0x8000}}) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f00000004c0)={'ip6tnl0\x00', &(0x7f0000000440)={'syztnl0\x00', 0x0, 0x4, 0xff, 0x2, 0xfff, 0x3e, @mcast2, @local, 0x20, 0x20, 0x140000, 0x1}}) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000200)="5ef275de7d674addf1e962901374df916bb7d23915f762f4fa27f5fb1ac255ecca5d692093c08536667599dbdde1328830c69cab2dd0a7ae376465261cdf048308ec7e6068b67ffd42d1ccd07d87187453262a8bb93a1089691fdf86474c4225bd9879a6f4b175f2e75f2de413d3b57d9f7577e70a5ca3db537316f66d98ded5427407219c79637602d0187c629b2e3c815f151ec5769d359ccb462d08a5f095c10c71c0533bf51c9058823f2c2922ff", 0xb0}, {&(0x7f00000002c0)="4621626a353f0390952f67962b44a139013b9a98923d8930112c7a499fba338de84fc7da70de275702c1ef41df23b3853ce212945736be0558d13f5d997caed2b5973387141e0bf560dc3931b9463bc8c1284014af43c36ce4a9bd703f92f4c69784292ebc78543f445c994d10f1af232fe7569a81eee36d84759f345832a2c4539d8f2272db1423a11daa77906a8c872dedfe99beb2fc3c9427362f5dbe8ccdccec65e1671d0c9f6996d0cdca3ee6c11cdef2bcecd1b848bb1c0934d35e4f310ca1911381c422f115a3f55e6f56c84cd1ab69882bf8b771ef9f862911e7ad1ceace21c63622ea3b9379150bc628eac078", 0xf1}], 0x2}, 0x8841) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x0, 0xd40f, 0x6, @dev={0xfe, 0x80, '\x00', 0x18}, @remote, 0x8, 0x8000, 0x7, 0x2ea}}) (async) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)={'ip6_vti0\x00', r0, 0x2f, 0x3, 0x3, 0x8000, 0x40, @loopback, @ipv4={'\x00', '\xff\xff', @remote}, 0x40, 0x10, 0x6, 0x8000}}) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f00000004c0)={'ip6tnl0\x00', &(0x7f0000000440)={'syztnl0\x00', 0x0, 0x4, 0xff, 0x2, 0xfff, 0x3e, @mcast2, @local, 0x20, 0x20, 0x140000, 0x1}}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$kcm(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000200)="5ef275de7d674addf1e962901374df916bb7d23915f762f4fa27f5fb1ac255ecca5d692093c08536667599dbdde1328830c69cab2dd0a7ae376465261cdf048308ec7e6068b67ffd42d1ccd07d87187453262a8bb93a1089691fdf86474c4225bd9879a6f4b175f2e75f2de413d3b57d9f7577e70a5ca3db537316f66d98ded5427407219c79637602d0187c629b2e3c815f151ec5769d359ccb462d08a5f095c10c71c0533bf51c9058823f2c2922ff", 0xb0}, {&(0x7f00000002c0)="4621626a353f0390952f67962b44a139013b9a98923d8930112c7a499fba338de84fc7da70de275702c1ef41df23b3853ce212945736be0558d13f5d997caed2b5973387141e0bf560dc3931b9463bc8c1284014af43c36ce4a9bd703f92f4c69784292ebc78543f445c994d10f1af232fe7569a81eee36d84759f345832a2c4539d8f2272db1423a11daa77906a8c872dedfe99beb2fc3c9427362f5dbe8ccdccec65e1671d0c9f6996d0cdca3ee6c11cdef2bcecd1b848bb1c0934d35e4f310ca1911381c422f115a3f55e6f56c84cd1ab69882bf8b771ef9f862911e7ad1ceace21c63622ea3b9379150bc628eac078", 0xf1}], 0x2}, 0x8841) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async) 10:01:50 executing program 5: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x1000000, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@privport}], [{@hash}, {@fsname={'fsname', 0x3d, '/dev/sg#\x00'}}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/sg#\x00'}}, {@smackfshat={'smackfshat', 0x3d, '/dev/sg#\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x31, 0x32, 0x37, 0x34, 0x37, 0x62, 0x62, 0x64], 0x2d, [0x33, 0x38, 0x63, 0x64], 0x2d, [0x34, 0x63, 0x66, 0x38], 0x2d, [0x35, 0x35, 0x61, 0x32], 0x2d, [0x36, 0x61, 0x34, 0x34, 0x64, 0x35, 0x30, 0x52]}}}]}}) (async) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x1267, &(0x7f0000000000)) [ 3387.763093][T30057] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 10:01:50 executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f62736700000000005d33069a8618189a361dcbb38c5b35416e577a0fcffa7c968dfbe72aeed3696027218fcbf2ed5931ab57cb7900a76a2996d971ae68bc760cc663a3cca85853c50be8bae25a6f429702219b231f1b251d2b9909043e9d4445346a21b9a3da643c5576331093659310c41538d82c8201569188f4236b2c4d0995d4ebd0f70983648b063eda0a46dca3ec"], 0x87ffff2) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x2040) syz_io_uring_setup(0x14fe, &(0x7f0000000080)={0x0, 0x18df, 0x10, 0x1, 0xc8}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = syz_open_dev$sg(&(0x7f0000000280), 0x8000, 0x48000) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r2, 0x8000000) syz_io_uring_setup(0x3d0f, &(0x7f0000000180)={0x0, 0x24fd, 0x4, 0x1, 0x215, 0x0, r2}, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000200), &(0x7f0000000240)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x203) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x203) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) 10:01:50 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509007a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a1d000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140533006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669000ff21256d4b13e69e13e7d71e1d1026256030e3daca28bcb86250576468abd96ada242caf03fe9e7d03510265c0d9b2f135f019647a3497eb8f0085acac2a0253d33cbc32ec07f8c020ac20e401016e5037f2bec7d98179906"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x22010080}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)=@deltfilter={0x90, 0x2d, 0x20, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0x4}, {0x2, 0x2}, {0x8, 0x4}}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_rsvp6={{0xa}, {0x58, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0xfffffffc, 0x3, 0xfffffffa}, {0x8, 0x7ff, 0x2}, 0x29, 0x0, 0x5}}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x800, 0x1d1, 0x4}, {0x1, 0x1, 0xff}, 0x1d, 0x3}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}]}}]}, 0x90}}, 0x1) accept4$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0xffffffff}, 0x10, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) timerfd_create(0x4, 0x800) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$IMGETCOUNT(r4, 0x80044943, &(0x7f00000000c0)) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async, rerun: 64) r2 = syz_io_uring_complete(r1) (rerun: 64) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (rerun: 32) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async, rerun: 32) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000400)) 10:01:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x20010, r3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000df6000/0x4000)=nil, 0x4000, 0x8, 0x8010, r0, 0x0) syz_io_uring_complete(r4) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0x8}) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:50 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x2040) syz_io_uring_setup(0x14fe, &(0x7f0000000080)={0x0, 0x18df, 0x10, 0x1, 0xc8}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) r1 = syz_open_dev$sg(&(0x7f0000000280), 0x8000, 0x48000) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) (async, rerun: 32) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (rerun: 32) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r2, 0x8000000) (async) syz_io_uring_setup(0x3d0f, &(0x7f0000000180)={0x0, 0x24fd, 0x4, 0x1, 0x215, 0x0, r2}, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000200), &(0x7f0000000240)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:50 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509007a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a1d000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140533006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669000ff21256d4b13e69e13e7d71e1d1026256030e3daca28bcb86250576468abd96ada242caf03fe9e7d03510265c0d9b2f135f019647a3497eb8f0085acac2a0253d33cbc32ec07f8c020ac20e401016e5037f2bec7d98179906"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x22010080}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)=@deltfilter={0x90, 0x2d, 0x20, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0x4}, {0x2, 0x2}, {0x8, 0x4}}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_rsvp6={{0xa}, {0x58, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0xfffffffc, 0x3, 0xfffffffa}, {0x8, 0x7ff, 0x2}, 0x29, 0x0, 0x5}}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x800, 0x1d1, 0x4}, {0x1, 0x1, 0xff}, 0x1d, 0x3}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}]}}]}, 0x90}}, 0x1) accept4$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0xffffffff}, 0x10, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) timerfd_create(0x4, 0x800) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$IMGETCOUNT(r4, 0x80044943, &(0x7f00000000c0)) 10:01:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x203) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000400)) 10:01:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async, rerun: 32) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x20010, r3, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000df6000/0x4000)=nil, 0x4000, 0x8, 0x8010, r0, 0x0) syz_io_uring_complete(r4) (async) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0x8}) (async, rerun: 64) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (rerun: 64) 10:01:50 executing program 4: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async, rerun: 64) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509007a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a1d000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140533006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669000ff21256d4b13e69e13e7d71e1d1026256030e3daca28bcb86250576468abd96ada242caf03fe9e7d03510265c0d9b2f135f019647a3497eb8f0085acac2a0253d33cbc32ec07f8c020ac20e401016e5037f2bec7d98179906"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (rerun: 32) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x22010080}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)=@deltfilter={0x90, 0x2d, 0x20, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0x4}, {0x2, 0x2}, {0x8, 0x4}}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_rsvp6={{0xa}, {0x58, 0x2, [@TCA_RSVP_PINFO={0x20, 0x4, {{0xfffffffc, 0x3, 0xfffffffa}, {0x8, 0x7ff, 0x2}, 0x29, 0x0, 0x5}}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x800, 0x1d1, 0x4}, {0x1, 0x1, 0xff}, 0x1d, 0x3}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}]}}]}, 0x90}}, 0x1) accept4$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0xffffffff}, 0x10, 0x0) (async) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) timerfd_create(0x4, 0x800) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async, rerun: 32) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) (async) ioctl$IMGETCOUNT(r4, 0x80044943, &(0x7f00000000c0)) 10:01:51 executing program 3: socket$nl_route(0x10, 0x3, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f62736700000000005d33069a8618189a361dcbb38c5b35416e577a0fcffa7c968dfbe72aeed3696027218fcbf2ed5931ab57cb7900a76a2996d971ae68bc760cc663a3cca85853c50be8bae25a6f429702219b231f1b251d2b9909043e9d4445346a21b9a3da643c5576331093659310c41538d82c8201569188f4236b2c4d0995d4ebd0f70983648b063eda0a46dca3ec"], 0x87ffff2) socket$nl_route(0x10, 0x3, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f62736700000000005d33069a8618189a361dcbb38c5b35416e577a0fcffa7c968dfbe72aeed3696027218fcbf2ed5931ab57cb7900a76a2996d971ae68bc760cc663a3cca85853c50be8bae25a6f429702219b231f1b251d2b9909043e9d4445346a21b9a3da643c5576331093659310c41538d82c8201569188f4236b2c4d0995d4ebd0f70983648b063eda0a46dca3ec"], 0x87ffff2) (async) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509000200738d7a31000000007da4e10200c1c01a1400330076657468315f746f5f62028b937d7269646765000900020073797a310000000008004100727865001400330076007468305f746f5f7465273d0000000900020073797a320000000008004100c323fc2c73697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a32001836bcd4847497d669770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f76691cb792087a38e5e405b918933d51800b256b61b08f691556d8faccc4752224c87a823e7f051ace31c9a8fe5d9ab5a26a430fb722c504003153aa62b7f66d949a7d791055e20fd9fc7d9422b64e7a4e73c348cdacc408f624de29cfef16458207bab2e8a64d6464ac952ff5a6afe224b224f762e0746131b00c26c188d12bf99ff43fe6a56f6b0a9eae9dd185eab3d52ab4374c84a87b19f8535ec302a1ffdbff"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r4 = syz_io_uring_complete(r3) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000400)=0x1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, 0x0, 0x0, 0x4) r6 = syz_io_uring_complete(r5) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r6}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410072786500140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797831000000000800410072786500140033006970766c616e300000000000000000000900020073797a320000f6000800410073697700140033000000000000000000ffff0000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x1000003, 0x10, r6, 0x0) ioctl$IMSETDEVNAME(r6, 0x80184947, &(0x7f00000000c0)={0x5, 'syz0\x00'}) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000080)=0x2, 0x4) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x20010, r3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000df6000/0x4000)=nil, 0x4000, 0x8, 0x8010, r0, 0x0) (async) syz_io_uring_complete(r4) (async) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000080)={0x8}) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 1: setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, 0xc) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f00000002c0)=0x7, 0x4) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8400) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000280)={0x1, 'ip6gretap0\x00', {}, 0x100}) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x2, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x0, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'wg0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_vlan\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000811}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x2201, &(0x7f0000000000)) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0xbea) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000100)) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x2040) (async) syz_io_uring_setup(0x14fe, &(0x7f0000000080)={0x0, 0x18df, 0x10, 0x1, 0xc8}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) (async) r1 = syz_open_dev$sg(&(0x7f0000000280), 0x8000, 0x48000) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) (async) r2 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r2, 0x8000000) (async) syz_io_uring_setup(0x3d0f, &(0x7f0000000180)={0x0, 0x24fd, 0x4, 0x1, 0x215, 0x0, r2}, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000200), &(0x7f0000000240)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) 10:01:51 executing program 1: setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, 0xc) (async, rerun: 64) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f00000002c0)=0x7, 0x4) (async, rerun: 64) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8400) (async, rerun: 64) r1 = socket$pptp(0x18, 0x1, 0x2) (rerun: 64) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) (async) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000280)={0x1, 'ip6gretap0\x00', {}, 0x100}) (async, rerun: 64) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x2, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x0, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'wg0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_vlan\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000811}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r3, 0x2201, &(0x7f0000000000)) (async, rerun: 32) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0xbea) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000100)) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x4cb101) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509000200738d7a31000000007da4e10200c1c01a1400330076657468315f746f5f62028b937d7269646765000900020073797a310000000008004100727865001400330076007468305f746f5f7465273d0000000900020073797a320000000008004100c323fc2c73697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a32001836bcd4847497d669770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f76691cb792087a38e5e405b918933d51800b256b61b08f691556d8faccc4752224c87a823e7f051ace31c9a8fe5d9ab5a26a430fb722c504003153aa62b7f66d949a7d791055e20fd9fc7d9422b64e7a4e73c348cdacc408f624de29cfef16458207bab2e8a64d6464ac952ff5a6afe224b224f762e0746131b00c26c188d12bf99ff43fe6a56f6b0a9eae9dd185eab3d52ab4374c84a87b19f8535ec302a1ffdbff"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r4 = syz_io_uring_complete(r3) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000400)=0x1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, 0x0, 0x0, 0x4) r6 = syz_io_uring_complete(r5) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r6}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410072786500140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797831000000000800410072786500140033006970766c616e300000000000000000000900020073797a320000f6000800410073697700140033000000000000000000ffff0000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x1000003, 0x10, r6, 0x0) ioctl$IMSETDEVNAME(r6, 0x80184947, &(0x7f00000000c0)={0x5, 'syz0\x00'}) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000080)=0x2, 0x4) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509000200738d7a31000000007da4e10200c1c01a1400330076657468315f746f5f62028b937d7269646765000900020073797a310000000008004100727865001400330076007468305f746f5f7465273d0000000900020073797a320000000008004100c323fc2c73697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a32001836bcd4847497d669770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f76691cb792087a38e5e405b918933d51800b256b61b08f691556d8faccc4752224c87a823e7f051ace31c9a8fe5d9ab5a26a430fb722c504003153aa62b7f66d949a7d791055e20fd9fc7d9422b64e7a4e73c348cdacc408f624de29cfef16458207bab2e8a64d6464ac952ff5a6afe224b224f762e0746131b00c26c188d12bf99ff43fe6a56f6b0a9eae9dd185eab3d52ab4374c84a87b19f8535ec302a1ffdbff"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) syz_io_uring_complete(r3) (async) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000400)=0x1) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r5) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r6}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410072786500140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797831000000000800410072786500140033006970766c616e300000000000000000000900020073797a320000f6000800410073697700140033000000000000000000ffff0000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x1000003, 0x10, r6, 0x0) (async) ioctl$IMSETDEVNAME(r6, 0x80184947, &(0x7f00000000c0)={0x5, 'syz0\x00'}) (async) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000080)=0x2, 0x4) (async) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x107000) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000080)={0x1, 'wg2\x00', {}, 0x8}) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x4cb101) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 3: socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (rerun: 64) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f62736700000000005d33069a8618189a361dcbb38c5b35416e577a0fcffa7c968dfbe72aeed3696027218fcbf2ed5931ab57cb7900a76a2996d971ae68bc760cc663a3cca85853c50be8bae25a6f429702219b231f1b251d2b9909043e9d4445346a21b9a3da643c5576331093659310c41538d82c8201569188f4236b2c4d0995d4ebd0f70983648b063eda0a46dca3ec"], 0x87ffff2) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x107000) (async) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000080)={0x1, 'wg2\x00', {}, 0x8}) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509000200738d7a31000000007da4e10200c1c01a1400330076657468315f746f5f62028b937d7269646765000900020073797a310000000008004100727865001400330076007468305f746f5f7465273d0000000900020073797a320000000008004100c323fc2c73697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a32001836bcd4847497d669770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f76691cb792087a38e5e405b918933d51800b256b61b08f691556d8faccc4752224c87a823e7f051ace31c9a8fe5d9ab5a26a430fb722c504003153aa62b7f66d949a7d791055e20fd9fc7d9422b64e7a4e73c348cdacc408f624de29cfef16458207bab2e8a64d6464ac952ff5a6afe224b224f762e0746131b00c26c188d12bf99ff43fe6a56f6b0a9eae9dd185eab3d52ab4374c84a87b19f8535ec302a1ffdbff"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r4 = syz_io_uring_complete(r3) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000400)=0x1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, 0x0, 0x0, 0x4) r6 = syz_io_uring_complete(r5) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r6}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410072786500140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797831000000000800410072786500140033006970766c616e300000000000000000000900020073797a320000f6000800410073697700140033000000000000000000ffff0000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x1000003, 0x10, r6, 0x0) ioctl$IMSETDEVNAME(r6, 0x80184947, &(0x7f00000000c0)={0x5, 'syz0\x00'}) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000080)=0x2, 0x4) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf2509000200738d7a31000000007da4e10200c1c01a1400330076657468315f746f5f62028b937d7269646765000900020073797a310000000008004100727865001400330076007468305f746f5f7465273d0000000900020073797a320000000008004100c323fc2c73697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a32001836bcd4847497d669770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f76691cb792087a38e5e405b918933d51800b256b61b08f691556d8faccc4752224c87a823e7f051ace31c9a8fe5d9ab5a26a430fb722c504003153aa62b7f66d949a7d791055e20fd9fc7d9422b64e7a4e73c348cdacc408f624de29cfef16458207bab2e8a64d6464ac952ff5a6afe224b224f762e0746131b00c26c188d12bf99ff43fe6a56f6b0a9eae9dd185eab3d52ab4374c84a87b19f8535ec302a1ffdbff"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) syz_io_uring_complete(r3) (async) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000400)=0x1) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r5) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r6}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410072786500140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797831000000000800410072786500140033006970766c616e300000000000000000000900020073797a320000f6000800410073697700140033000000000000000000ffff0000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fed000/0x13000)=nil, 0x13000, 0x1000003, 0x10, r6, 0x0) (async) ioctl$IMSETDEVNAME(r6, 0x80184947, &(0x7f00000000c0)={0x5, 'syz0\x00'}) (async) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f0000000080)=0x2, 0x4) (async) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x4cb101) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x4cb101) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:51 executing program 1: setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, 0xc) (async) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f00000002c0)=0x7, 0x4) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8400) (async) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000280)={0x1, 'ip6gretap0\x00', {}, 0x100}) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x2, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x0, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'wg0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_vlan\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000811}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r3, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000080)=0xbea) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000100)) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x4d0480) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000001340)) ioctl$SG_IO(r0, 0x2285, &(0x7f00000012c0)={0x0, 0xfffffffffffffffb, 0xaa, 0x7, @scatter={0x2, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000080)=""/45, 0x2d}, {&(0x7f00000000c0)=""/4096, 0x1000}]}, &(0x7f0000001100)="bc5c82e5ace17ee8d680a3aca463cf655ebddcde7ffcd6f35b395d0efd7f8db7470596648384a6c42b88e133ab50dfd6d15041882279eb0213fe10a16747f34ecc6698cde9090def486b16059559a15c74cd4a752906d9eccf0aab83b2d5c35063c2e169b9edc7b23aa4e1ed2641145e8d2831b3e0d5640953673d90790685141a29057a66b9768cad41c02e026d7a2e7b965e815e939d1ccc53312c98534a29a44c030496d02dd087fe", &(0x7f0000001380)=""/149, 0xc5f4, 0x1, 0x3, &(0x7f0000001280)}) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_WRITE_FIXED={0x5, 0x2, 0x6000, @fd_index=0x2, 0x2, 0x2, 0x1f, 0xa, 0x0, {0x3}}, 0x1) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) write$P9_RREADLINK(r2, &(0x7f00000000c0)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x107000) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000080)={0x1, 'wg2\x00', {}, 0x8}) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x107000) (async) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000080)={0x1, 'wg2\x00', {}, 0x8}) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) (async) 10:01:51 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x80000000, 0x422001) r0 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:51 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) 10:01:51 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) syz_open_dev$sg(&(0x7f0000000080), 0x80000000, 0x422001) (async, rerun: 64) r0 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:51 executing program 0: bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000001100)={0xffffffffffffffff}, 0x4) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x1000, 0x9, 0x3, "cef5d59a206b3b4c3acc254010a4b19ed2c86f21f05828e65589301f59f90ff17d8446c614b2cae394efb959c366a270e9259f7415d7e90167e076c77b786d35a3596c51d3a987e67194888a13f0101950d5efaeae00f3e0150e822a6aae644ace9f74bb269edf0eaece924e2e2b07eded19168aea6308c776e8194add6539e98f09445e84fcbac65036d6f2a9255db67a33da3ac39399e4b7db2f0e843d361c4d8d1d02ac0c462c2e06f63a2c15a06d8013f013350514cdd338a19b34385b5454dad992c35e649263a2b939066ae281d860bade77f5babf9a28572f2fef4f041b12d3361516bbd10db21b0557d7448b7bdc8add55f2436113f7bc93c7db1117f5d1de92c146689b567629ae4ea140d65ea9b0ba054a8586bc07b739bd40122d0392c6fb99fbfd8f1c572a2d85ecd8e5b4d29e319f43da0d89f9037715d5cd7f76716a439df9470075da21a8e444111be595830851fc171bcbf6c76da1ce2692945adadb8f157a7adf57873caf193ce9a1f928035cf8d0374cce649995425f2292f26e39b2aa25fddb335f062762e4f20ca9cdb99523fbc660b8dcb0cb066bf2514dd1dbf51165a8684e1b39c5d5113b87c0f4073bf3ef4ce9686663b211afffd4b3433b0202741a1206c4fc9ac0d08738689c3ec8781ba25576ee82291323cf30a5677042b032aa85f20f60b4be737d646f2c469427ca09311e9436fe910ec03420096bb060040cbf6dc2817678f2e5d995b9f95afeac6b69d45de2e5faa36142f3b69cceb558884c1f558e72b5c1cad123a3dced5c2e54cf28772a7e4da64b7e303fccb6972c09f422002c1836f564cd4f41dd9158a474a9a2ffc914007fe010ba2fa3748d4852e7f136d811526cf95b037bca34b7fbcf041077e136bf0aba6ee7c03db626db6527062828ff37b34847316784119bab8cdd52fadb7e9497874b79faa0621d0a6d5ae842f0a0dc20bbc741fb80dbe8f17bb7eb7985e8291fdfdbfb7b1ba51b019d1a7cb7958eb9ff9d19ea3d2e9f0ac9eb032b51a162d4aa5f907cc7203a823f6bd92b6997a787c99e020be02a04dc94e985b400939debdbc10b8272d853db54f80f2858c14c9efe8fd424343f71c42ed7446009f7bad1cd46bfb2277c58bf91100d230e634cc77b7bc2fdd22d918974f3b1a44f847dc2b9dcdda459b9f3a82d3b07ea2ece02c3d82128080d95bff9f84000b1b5c807294deb36abe10324faf3fbebd3514e6a54d7dd89c17535eefa1305599f2af418247f708c21ff14c6314717262f3dfccd0ea4bf8d0c195f809033655f2a7d3dfeccb72ab9b175047e589c2067fffbde1f90b07c1ccf824b9c7938d6632255e4bec76eb415a11d8b955663d0d23e28289f2413c0d903ffd71376534e6c7e164dd8eddc928f8824f0d8c408a51e6331790346c6b6085d355c4435499f23b5db359e13791bebd4e6d53c6985fd38a1eec569ae276381ff89aecc42273e61758c0bd2fc9ed34217603741e6df40de095da4b88a5805af5cf0f0f47461e686fca537777096ab21296d15dec333f9e5c0040443f1401e4c09ebeee1bdb15f599b212d6010830c423274bef6c306b8aec3322b41f90e2781efa53c01d0655dd049b536480db619d1405d44ea47826025af2d9da9daef519330feec70f48617409e59bc49745922f0ccd9cff7ad9928875f569573f4318479fb8f065c22cd45c367c80fde9e71c0374c72f6d8e5cc1fc79afa67362bc1c9b8906c5143912567e04a1f5ee7aadf82a89a41b5feeedb7a5494a715848b3623c3f60d358b8351e6f7183eb00e9bcd113002fe98794fa2a48766a67c11bfce405de754c2be2de43ce8b127d6ef898e025ffc1b2fcacee041bb180a1ac5d299b7bd804500410ad1e26c30aabf7862eae982767d2b7333e03a12ef944dbe410e99b6025471f172adb9aee654a1ef1fb34ba1bee23fc935b6c087b25d6dcb5f9f57317771e582249a4a19b7baecfd0e40ced9a96bfefb92e07280deac02fec3897816a36defcd5f3b34057434ab5f63b7ccf6ede9f2959e308d026f6d5b7f2296822afd6298c9f0ed9ada3c285ebec1df67305bfeb300501eb81814b53263b57cfb82ad8261f0ecea26bff28e138bb69b4debb7a533828ba94c971e46ed6c8b696c8ec2f9c24632533aa5d1d2a5e23cb5efd538fb8b8e28a4b9e5f2f65d41be18eae0b24e9b12b12506c7dc4a64447f73e4e27a73ea1822feb77a10d9c6fb034967065ed42ea51d1c4dc0d165e208a1642940e1701dc44ab0f0459ea9ae053e19f347b8d3c261bcd303f0ee243360385dfa6e9dd890db7670e55a9cacbd501682344b2b6cae81f074183513be2f696a32e26e92aeb2cb61657954765c72775514f02bca9960725d79676f26162472956faaa284b84cb2015821f50a78789d9f8103d6e2dbcbb046fd8a29239ccd6b032ed9b49ebc585bcfa89b5d0d686957cde86156d698008465adee01ce4bfd401acf4d3be0f16ca9734d0fd5ec8f38ed7b082f7deaa4162809a2eaeaf0da9061c6ad59396791f16fe05bda9afc67469913c02feb643e58ae5b6e6720ad02d5fcb27f4f3753a82780ded1eca0c144819005492b744fccb77c3e8adf019a6fc170da85f2024714d21c819870e268e6ea6e3ec528204d17fca01630a809834fb749d35049f646514d1104615a6a966a36f22f78bbe2c25f96bec0b2589782739c46df19e131665a367c62322f31402e83020222ef62b392f0bd9d44d1a9fe35d4d5613f9766a9f60c9452978b570373d566812f25acf6f6aabf60ba07074aab679750eb22c1b821a5016707853c8690682c0b5a605025843e7df61ac15318fa6577989cc20ac1d4949365d82ecdaed04ac1c993e6f0a9cfbfcbe4a752840a98ee9ba548fe1c67dc39b45896a459574b5ab2f748d8579bff5be15c7a3516c25a2607797af18be9183fa8cc14867cd5e0668b78ad01fcb9b598136b0490de2fd5cf382b5335e31a824f42258a21fd4887db4dda4614b5fb095a056fbc3e42b40dc927242e9a601bd8a52544cf159a00e1907561bd31fb44e163ff370a2837b5fbafb665135b3656ac78b9bc782d6971486ea090471f400594005498b0f30097233725672c62d1d3d1563b6d8e8a7052ac3b12ee54874f3a6c58c9675687797b36d40dc47c9dc28487d2202f4615a3b407fc7e1a84364d2e66a396757f3c98fbb6f9d25eedc9f2ffd850a0e36f6e38af8a71bb8c88c78da42146f10ccc4754e3d342df3074356ba8f582c024059c5cfc83358e1da81ee0f8328d7fb2e2c0c8f525b75de1d0fd7713f45b2a89f8d8427f2cb2f3f0dad1c723ea9da456bb1555c8d320805bc5e8e1ee255e0b617bda7d6e67c34b405bd01f8731aa58e5107512d8d9e9a2fb347f7b46ed793a604a563ba9fba7dce8541aff9f73860093acefc39dd5de43f4b0f484a36c6142d023abea7b368bb5ff9188aa020d29b7449c7ac8d932b9482683496754d8b181ed09925be7829276ea8f4cafe8cf716c6b15970ebf0af60e63374bcda0877e5c2ac2c11ee4b22803867f5f5f221b4693d388dd9716504edb98fbb59da865e306c8a5b17dc77eb8fcf44e507d84f096eee5b5196d6e8460d3fb23ef7083b1b5998897234bc8b839c40e55212c6252b4e37b2b0de608641b85793f6ad7019d34f486371f46585d51c3b7412123fb527251444b4cf03ce4a44a8fb2e5929cb77d037d8588c4251295ea1341b691b0aef143b3b3ffe5155c0268933e7738fcc0e603ef8a69cd5d328ce0ebd38c1b7ba2ced6b595611995d0022057d9df0318de1c53141929c5a4036157f0f6adae3a3c80cd476102dabf4b6fb6083574a22d51504e426599c34fb47f948f3a384571afdd213d2b4c4769b0a9b6a484f067888df5b63b81b097f04f7f57cc94338fae0486b56752f9761993688e16e1b5b50c9bd5030c01f14ee084f1df23b73cbb32a8b97cb6bca548a1fea42028571f234edb2b047c6f256c19aa974e28827229dddb7a1def10109f819cc6fd40ab18a6b33573e32991cfc2ee05e33509b08d983da433a974c3d01afc5230b0b1813421fb4cf355c1b284fc7bae9f30d2573f89b4e2a989cfc4d96c9768f1c55e49ad5f87336e15484f10fb684aea2010b11e6f6b894098e5af525ef2158f6eb1e94ba010d6cc58cf8dd8e04548c3f2fb28a103eeb583720e2a6ef199c583bc1dd9d79cd39848e14821df70428297af11d954fcd3d7a9355eb777719c38577ac80fb67f32eaea3d6b9466f642108d910abf8490db0f8e88622b444d6dce937408c119d6fc104657d9133d75ada448681f9e8bb8c23552199f86c9ca819acd17636c1f9093e32aa68549178dcb33748eaf740707f3c0489619137de47610b8fa86735013b05b38a5dfb02ef452aa9f4c7d9f0b3bc2f9c9476b0729e5133de17b31bf4d36fd21abfc4e25419799b54f25fe01feb811923ad80adb1ff280db819a53c1c8c33a6a7b3120f30fa225d12c001b80750fb13b16ea415636185f83cf64607b88200d9f7dc7d005f5aabc44d847b0d30c47f2822810a41b7d15c4e99253a5e0bb3dba6bb800f797ef94032eaf97fed36b884ac5dcfb944707f4cd45eb2aed891150bcb9da98bfc885d5a42919434e542a312100c19fd3cdadfcc64531e56beac29c6ff762a2a28cf0e950ce25836ab66f53137cde8db9dceefcc11c5b519d9441b9091384947f3849197f012e5d529cb19140700568d2d290813e74e91913a0dc9095e8778418caab6d34f667858eb903ff1737109ff8d9264788ba39b62d325518d797fdd5485d56096a041d04336d7a7fdfb79d61b8f46ee2963dd5787c1d254d943d96b6483047399c1829aa1dc6eaa59fb5876b423193913eebcf6dac34262945251f407b1018251d42b9d914ed13c6c54049f28ba11ff2fdecf489c8e4f40893e6d7e9c32818f8c3641a65aae46a702063f488c5d10386fcf5f30ee0ab32f2bbb9da254ba443703eb865fcdc0cf97dd9fd52c047112678eb3397cb2c99f43b08ee59902dacadf3458a382c0e0dedb152f26a70cd117d89aed48b425d415243ec5b5d26af984c307f58cb6d2bf1901591b348e34cf6aae652d77cf66c081be47b2aae71fd39c8d391cb06f4d89730b89f2370daaf5d18193cc76a7047a890ff105e8feab2354fd4ecd1225855b9eb174e2ab19c5b1128d8a4381c817052fe0d63095e23aad0813a150acb85ed8425190ddcd4b0cac615be4a5512b01d6dda9b00d75a671b7126e53cde374c0db770e8230e6c8b47a5f62c63febeea98612411e8703d9818cc38b8a74d11f38bc79d059acdbfe2c5e31a99d445fe6d2672a8a5da9c95157cd574285829f60e8e55bbe42ed2a31c7b82bda3f30e1cc577652c061c57c422c53dbce3bdc37b479e38e0e7bd30fefdabaac172ddd7dddd0dc94aa71c0bf36207bca581b85d6c8915c9ca9d08c856f26eb68c1a756a83b8f63c424dcf6c4c08abd2cc4e0f6b1acb4b973a3de53cca823eab368e19c3b171de9b339fb001c61366a04669e7614bd426b7fca37beeeb48c6a13110f04722c0ed9772f42bd2bf30d5a52ba8d9d2966e1d22e33e7e697230f53b51bfafff23de25ca14ba028461ec7a753349b5b1dba169206cf2d31177524042b8aea07595657f62d0478020e3b5e89eae61308003f15713e103c985d2f58d86afcff57dc58e11b0143143308307120c1db7b1fdef1c341118485a6208d8471066b3142896a242b47f000a4e121f2c94a7dbe6ade731b38b2bf247664950c3e52fbad0b24d442c9240"}) r2 = syz_open_dev$sg(&(0x7f0000001140), 0x7, 0x84803) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000001180)=0x1) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x4d0480) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async, rerun: 64) r2 = syz_io_uring_complete(r1) (rerun: 64) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000001340)) (async) ioctl$SG_IO(r0, 0x2285, &(0x7f00000012c0)={0x0, 0xfffffffffffffffb, 0xaa, 0x7, @scatter={0x2, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000080)=""/45, 0x2d}, {&(0x7f00000000c0)=""/4096, 0x1000}]}, &(0x7f0000001100)="bc5c82e5ace17ee8d680a3aca463cf655ebddcde7ffcd6f35b395d0efd7f8db7470596648384a6c42b88e133ab50dfd6d15041882279eb0213fe10a16747f34ecc6698cde9090def486b16059559a15c74cd4a752906d9eccf0aab83b2d5c35063c2e169b9edc7b23aa4e1ed2641145e8d2831b3e0d5640953673d90790685141a29057a66b9768cad41c02e026d7a2e7b965e815e939d1ccc53312c98534a29a44c030496d02dd087fe", &(0x7f0000001380)=""/149, 0xc5f4, 0x1, 0x3, &(0x7f0000001280)}) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_WRITE_FIXED={0x5, 0x2, 0x6000, @fd_index=0x2, 0x2, 0x2, 0x1f, 0xa, 0x0, {0x3}}, 0x1) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) write$P9_RREADLINK(r2, &(0x7f00000000c0)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) (async) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) (async) 10:01:51 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x80000000, 0x422001) r0 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x80000000, 0x422001) (async) bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x404801) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:51 executing program 0: bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000001100)={0xffffffffffffffff}, 0x4) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x1000, 0x9, 0x3, "cef5d59a206b3b4c3acc254010a4b19ed2c86f21f05828e65589301f59f90ff17d8446c614b2cae394efb959c366a270e9259f7415d7e90167e076c77b786d35a3596c51d3a987e67194888a13f0101950d5efaeae00f3e0150e822a6aae644ace9f74bb269edf0eaece924e2e2b07eded19168aea6308c776e8194add6539e98f09445e84fcbac65036d6f2a9255db67a33da3ac39399e4b7db2f0e843d361c4d8d1d02ac0c462c2e06f63a2c15a06d8013f013350514cdd338a19b34385b5454dad992c35e649263a2b939066ae281d860bade77f5babf9a28572f2fef4f041b12d3361516bbd10db21b0557d7448b7bdc8add55f2436113f7bc93c7db1117f5d1de92c146689b567629ae4ea140d65ea9b0ba054a8586bc07b739bd40122d0392c6fb99fbfd8f1c572a2d85ecd8e5b4d29e319f43da0d89f9037715d5cd7f76716a439df9470075da21a8e444111be595830851fc171bcbf6c76da1ce2692945adadb8f157a7adf57873caf193ce9a1f928035cf8d0374cce649995425f2292f26e39b2aa25fddb335f062762e4f20ca9cdb99523fbc660b8dcb0cb066bf2514dd1dbf51165a8684e1b39c5d5113b87c0f4073bf3ef4ce9686663b211afffd4b3433b0202741a1206c4fc9ac0d08738689c3ec8781ba25576ee82291323cf30a5677042b032aa85f20f60b4be737d646f2c469427ca09311e9436fe910ec03420096bb060040cbf6dc2817678f2e5d995b9f95afeac6b69d45de2e5faa36142f3b69cceb558884c1f558e72b5c1cad123a3dced5c2e54cf28772a7e4da64b7e303fccb6972c09f422002c1836f564cd4f41dd9158a474a9a2ffc914007fe010ba2fa3748d4852e7f136d811526cf95b037bca34b7fbcf041077e136bf0aba6ee7c03db626db6527062828ff37b34847316784119bab8cdd52fadb7e9497874b79faa0621d0a6d5ae842f0a0dc20bbc741fb80dbe8f17bb7eb7985e8291fdfdbfb7b1ba51b019d1a7cb7958eb9ff9d19ea3d2e9f0ac9eb032b51a162d4aa5f907cc7203a823f6bd92b6997a787c99e020be02a04dc94e985b400939debdbc10b8272d853db54f80f2858c14c9efe8fd424343f71c42ed7446009f7bad1cd46bfb2277c58bf91100d230e634cc77b7bc2fdd22d918974f3b1a44f847dc2b9dcdda459b9f3a82d3b07ea2ece02c3d82128080d95bff9f84000b1b5c807294deb36abe10324faf3fbebd3514e6a54d7dd89c17535eefa1305599f2af418247f708c21ff14c6314717262f3dfccd0ea4bf8d0c195f809033655f2a7d3dfeccb72ab9b175047e589c2067fffbde1f90b07c1ccf824b9c7938d6632255e4bec76eb415a11d8b955663d0d23e28289f2413c0d903ffd71376534e6c7e164dd8eddc928f8824f0d8c408a51e6331790346c6b6085d355c4435499f23b5db359e13791bebd4e6d53c6985fd38a1eec569ae276381ff89aecc42273e61758c0bd2fc9ed34217603741e6df40de095da4b88a5805af5cf0f0f47461e686fca537777096ab21296d15dec333f9e5c0040443f1401e4c09ebeee1bdb15f599b212d6010830c423274bef6c306b8aec3322b41f90e2781efa53c01d0655dd049b536480db619d1405d44ea47826025af2d9da9daef519330feec70f48617409e59bc49745922f0ccd9cff7ad9928875f569573f4318479fb8f065c22cd45c367c80fde9e71c0374c72f6d8e5cc1fc79afa67362bc1c9b8906c5143912567e04a1f5ee7aadf82a89a41b5feeedb7a5494a715848b3623c3f60d358b8351e6f7183eb00e9bcd113002fe98794fa2a48766a67c11bfce405de754c2be2de43ce8b127d6ef898e025ffc1b2fcacee041bb180a1ac5d299b7bd804500410ad1e26c30aabf7862eae982767d2b7333e03a12ef944dbe410e99b6025471f172adb9aee654a1ef1fb34ba1bee23fc935b6c087b25d6dcb5f9f57317771e582249a4a19b7baecfd0e40ced9a96bfefb92e07280deac02fec3897816a36defcd5f3b34057434ab5f63b7ccf6ede9f2959e308d026f6d5b7f2296822afd6298c9f0ed9ada3c285ebec1df67305bfeb300501eb81814b53263b57cfb82ad8261f0ecea26bff28e138bb69b4debb7a533828ba94c971e46ed6c8b696c8ec2f9c24632533aa5d1d2a5e23cb5efd538fb8b8e28a4b9e5f2f65d41be18eae0b24e9b12b12506c7dc4a64447f73e4e27a73ea1822feb77a10d9c6fb034967065ed42ea51d1c4dc0d165e208a1642940e1701dc44ab0f0459ea9ae053e19f347b8d3c261bcd303f0ee243360385dfa6e9dd890db7670e55a9cacbd501682344b2b6cae81f074183513be2f696a32e26e92aeb2cb61657954765c72775514f02bca9960725d79676f26162472956faaa284b84cb2015821f50a78789d9f8103d6e2dbcbb046fd8a29239ccd6b032ed9b49ebc585bcfa89b5d0d686957cde86156d698008465adee01ce4bfd401acf4d3be0f16ca9734d0fd5ec8f38ed7b082f7deaa4162809a2eaeaf0da9061c6ad59396791f16fe05bda9afc67469913c02feb643e58ae5b6e6720ad02d5fcb27f4f3753a82780ded1eca0c144819005492b744fccb77c3e8adf019a6fc170da85f2024714d21c819870e268e6ea6e3ec528204d17fca01630a809834fb749d35049f646514d1104615a6a966a36f22f78bbe2c25f96bec0b2589782739c46df19e131665a367c62322f31402e83020222ef62b392f0bd9d44d1a9fe35d4d5613f9766a9f60c9452978b570373d566812f25acf6f6aabf60ba07074aab679750eb22c1b821a5016707853c8690682c0b5a605025843e7df61ac15318fa6577989cc20ac1d4949365d82ecdaed04ac1c993e6f0a9cfbfcbe4a752840a98ee9ba548fe1c67dc39b45896a459574b5ab2f748d8579bff5be15c7a3516c25a2607797af18be9183fa8cc14867cd5e0668b78ad01fcb9b598136b0490de2fd5cf382b5335e31a824f42258a21fd4887db4dda4614b5fb095a056fbc3e42b40dc927242e9a601bd8a52544cf159a00e1907561bd31fb44e163ff370a2837b5fbafb665135b3656ac78b9bc782d6971486ea090471f400594005498b0f30097233725672c62d1d3d1563b6d8e8a7052ac3b12ee54874f3a6c58c9675687797b36d40dc47c9dc28487d2202f4615a3b407fc7e1a84364d2e66a396757f3c98fbb6f9d25eedc9f2ffd850a0e36f6e38af8a71bb8c88c78da42146f10ccc4754e3d342df3074356ba8f582c024059c5cfc83358e1da81ee0f8328d7fb2e2c0c8f525b75de1d0fd7713f45b2a89f8d8427f2cb2f3f0dad1c723ea9da456bb1555c8d320805bc5e8e1ee255e0b617bda7d6e67c34b405bd01f8731aa58e5107512d8d9e9a2fb347f7b46ed793a604a563ba9fba7dce8541aff9f73860093acefc39dd5de43f4b0f484a36c6142d023abea7b368bb5ff9188aa020d29b7449c7ac8d932b9482683496754d8b181ed09925be7829276ea8f4cafe8cf716c6b15970ebf0af60e63374bcda0877e5c2ac2c11ee4b22803867f5f5f221b4693d388dd9716504edb98fbb59da865e306c8a5b17dc77eb8fcf44e507d84f096eee5b5196d6e8460d3fb23ef7083b1b5998897234bc8b839c40e55212c6252b4e37b2b0de608641b85793f6ad7019d34f486371f46585d51c3b7412123fb527251444b4cf03ce4a44a8fb2e5929cb77d037d8588c4251295ea1341b691b0aef143b3b3ffe5155c0268933e7738fcc0e603ef8a69cd5d328ce0ebd38c1b7ba2ced6b595611995d0022057d9df0318de1c53141929c5a4036157f0f6adae3a3c80cd476102dabf4b6fb6083574a22d51504e426599c34fb47f948f3a384571afdd213d2b4c4769b0a9b6a484f067888df5b63b81b097f04f7f57cc94338fae0486b56752f9761993688e16e1b5b50c9bd5030c01f14ee084f1df23b73cbb32a8b97cb6bca548a1fea42028571f234edb2b047c6f256c19aa974e28827229dddb7a1def10109f819cc6fd40ab18a6b33573e32991cfc2ee05e33509b08d983da433a974c3d01afc5230b0b1813421fb4cf355c1b284fc7bae9f30d2573f89b4e2a989cfc4d96c9768f1c55e49ad5f87336e15484f10fb684aea2010b11e6f6b894098e5af525ef2158f6eb1e94ba010d6cc58cf8dd8e04548c3f2fb28a103eeb583720e2a6ef199c583bc1dd9d79cd39848e14821df70428297af11d954fcd3d7a9355eb777719c38577ac80fb67f32eaea3d6b9466f642108d910abf8490db0f8e88622b444d6dce937408c119d6fc104657d9133d75ada448681f9e8bb8c23552199f86c9ca819acd17636c1f9093e32aa68549178dcb33748eaf740707f3c0489619137de47610b8fa86735013b05b38a5dfb02ef452aa9f4c7d9f0b3bc2f9c9476b0729e5133de17b31bf4d36fd21abfc4e25419799b54f25fe01feb811923ad80adb1ff280db819a53c1c8c33a6a7b3120f30fa225d12c001b80750fb13b16ea415636185f83cf64607b88200d9f7dc7d005f5aabc44d847b0d30c47f2822810a41b7d15c4e99253a5e0bb3dba6bb800f797ef94032eaf97fed36b884ac5dcfb944707f4cd45eb2aed891150bcb9da98bfc885d5a42919434e542a312100c19fd3cdadfcc64531e56beac29c6ff762a2a28cf0e950ce25836ab66f53137cde8db9dceefcc11c5b519d9441b9091384947f3849197f012e5d529cb19140700568d2d290813e74e91913a0dc9095e8778418caab6d34f667858eb903ff1737109ff8d9264788ba39b62d325518d797fdd5485d56096a041d04336d7a7fdfb79d61b8f46ee2963dd5787c1d254d943d96b6483047399c1829aa1dc6eaa59fb5876b423193913eebcf6dac34262945251f407b1018251d42b9d914ed13c6c54049f28ba11ff2fdecf489c8e4f40893e6d7e9c32818f8c3641a65aae46a702063f488c5d10386fcf5f30ee0ab32f2bbb9da254ba443703eb865fcdc0cf97dd9fd52c047112678eb3397cb2c99f43b08ee59902dacadf3458a382c0e0dedb152f26a70cd117d89aed48b425d415243ec5b5d26af984c307f58cb6d2bf1901591b348e34cf6aae652d77cf66c081be47b2aae71fd39c8d391cb06f4d89730b89f2370daaf5d18193cc76a7047a890ff105e8feab2354fd4ecd1225855b9eb174e2ab19c5b1128d8a4381c817052fe0d63095e23aad0813a150acb85ed8425190ddcd4b0cac615be4a5512b01d6dda9b00d75a671b7126e53cde374c0db770e8230e6c8b47a5f62c63febeea98612411e8703d9818cc38b8a74d11f38bc79d059acdbfe2c5e31a99d445fe6d2672a8a5da9c95157cd574285829f60e8e55bbe42ed2a31c7b82bda3f30e1cc577652c061c57c422c53dbce3bdc37b479e38e0e7bd30fefdabaac172ddd7dddd0dc94aa71c0bf36207bca581b85d6c8915c9ca9d08c856f26eb68c1a756a83b8f63c424dcf6c4c08abd2cc4e0f6b1acb4b973a3de53cca823eab368e19c3b171de9b339fb001c61366a04669e7614bd426b7fca37beeeb48c6a13110f04722c0ed9772f42bd2bf30d5a52ba8d9d2966e1d22e33e7e697230f53b51bfafff23de25ca14ba028461ec7a753349b5b1dba169206cf2d31177524042b8aea07595657f62d0478020e3b5e89eae61308003f15713e103c985d2f58d86afcff57dc58e11b0143143308307120c1db7b1fdef1c341118485a6208d8471066b3142896a242b47f000a4e121f2c94a7dbe6ade731b38b2bf247664950c3e52fbad0b24d442c9240"}) r2 = syz_open_dev$sg(&(0x7f0000001140), 0x7, 0x84803) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000001180)=0x1) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000001100)={0xffffffffffffffff}, 0x4) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x1000, 0x9, 0x3, "cef5d59a206b3b4c3acc254010a4b19ed2c86f21f05828e65589301f59f90ff17d8446c614b2cae394efb959c366a270e9259f7415d7e90167e076c77b786d35a3596c51d3a987e67194888a13f0101950d5efaeae00f3e0150e822a6aae644ace9f74bb269edf0eaece924e2e2b07eded19168aea6308c776e8194add6539e98f09445e84fcbac65036d6f2a9255db67a33da3ac39399e4b7db2f0e843d361c4d8d1d02ac0c462c2e06f63a2c15a06d8013f013350514cdd338a19b34385b5454dad992c35e649263a2b939066ae281d860bade77f5babf9a28572f2fef4f041b12d3361516bbd10db21b0557d7448b7bdc8add55f2436113f7bc93c7db1117f5d1de92c146689b567629ae4ea140d65ea9b0ba054a8586bc07b739bd40122d0392c6fb99fbfd8f1c572a2d85ecd8e5b4d29e319f43da0d89f9037715d5cd7f76716a439df9470075da21a8e444111be595830851fc171bcbf6c76da1ce2692945adadb8f157a7adf57873caf193ce9a1f928035cf8d0374cce649995425f2292f26e39b2aa25fddb335f062762e4f20ca9cdb99523fbc660b8dcb0cb066bf2514dd1dbf51165a8684e1b39c5d5113b87c0f4073bf3ef4ce9686663b211afffd4b3433b0202741a1206c4fc9ac0d08738689c3ec8781ba25576ee82291323cf30a5677042b032aa85f20f60b4be737d646f2c469427ca09311e9436fe910ec03420096bb060040cbf6dc2817678f2e5d995b9f95afeac6b69d45de2e5faa36142f3b69cceb558884c1f558e72b5c1cad123a3dced5c2e54cf28772a7e4da64b7e303fccb6972c09f422002c1836f564cd4f41dd9158a474a9a2ffc914007fe010ba2fa3748d4852e7f136d811526cf95b037bca34b7fbcf041077e136bf0aba6ee7c03db626db6527062828ff37b34847316784119bab8cdd52fadb7e9497874b79faa0621d0a6d5ae842f0a0dc20bbc741fb80dbe8f17bb7eb7985e8291fdfdbfb7b1ba51b019d1a7cb7958eb9ff9d19ea3d2e9f0ac9eb032b51a162d4aa5f907cc7203a823f6bd92b6997a787c99e020be02a04dc94e985b400939debdbc10b8272d853db54f80f2858c14c9efe8fd424343f71c42ed7446009f7bad1cd46bfb2277c58bf91100d230e634cc77b7bc2fdd22d918974f3b1a44f847dc2b9dcdda459b9f3a82d3b07ea2ece02c3d82128080d95bff9f84000b1b5c807294deb36abe10324faf3fbebd3514e6a54d7dd89c17535eefa1305599f2af418247f708c21ff14c6314717262f3dfccd0ea4bf8d0c195f809033655f2a7d3dfeccb72ab9b175047e589c2067fffbde1f90b07c1ccf824b9c7938d6632255e4bec76eb415a11d8b955663d0d23e28289f2413c0d903ffd71376534e6c7e164dd8eddc928f8824f0d8c408a51e6331790346c6b6085d355c4435499f23b5db359e13791bebd4e6d53c6985fd38a1eec569ae276381ff89aecc42273e61758c0bd2fc9ed34217603741e6df40de095da4b88a5805af5cf0f0f47461e686fca537777096ab21296d15dec333f9e5c0040443f1401e4c09ebeee1bdb15f599b212d6010830c423274bef6c306b8aec3322b41f90e2781efa53c01d0655dd049b536480db619d1405d44ea47826025af2d9da9daef519330feec70f48617409e59bc49745922f0ccd9cff7ad9928875f569573f4318479fb8f065c22cd45c367c80fde9e71c0374c72f6d8e5cc1fc79afa67362bc1c9b8906c5143912567e04a1f5ee7aadf82a89a41b5feeedb7a5494a715848b3623c3f60d358b8351e6f7183eb00e9bcd113002fe98794fa2a48766a67c11bfce405de754c2be2de43ce8b127d6ef898e025ffc1b2fcacee041bb180a1ac5d299b7bd804500410ad1e26c30aabf7862eae982767d2b7333e03a12ef944dbe410e99b6025471f172adb9aee654a1ef1fb34ba1bee23fc935b6c087b25d6dcb5f9f57317771e582249a4a19b7baecfd0e40ced9a96bfefb92e07280deac02fec3897816a36defcd5f3b34057434ab5f63b7ccf6ede9f2959e308d026f6d5b7f2296822afd6298c9f0ed9ada3c285ebec1df67305bfeb300501eb81814b53263b57cfb82ad8261f0ecea26bff28e138bb69b4debb7a533828ba94c971e46ed6c8b696c8ec2f9c24632533aa5d1d2a5e23cb5efd538fb8b8e28a4b9e5f2f65d41be18eae0b24e9b12b12506c7dc4a64447f73e4e27a73ea1822feb77a10d9c6fb034967065ed42ea51d1c4dc0d165e208a1642940e1701dc44ab0f0459ea9ae053e19f347b8d3c261bcd303f0ee243360385dfa6e9dd890db7670e55a9cacbd501682344b2b6cae81f074183513be2f696a32e26e92aeb2cb61657954765c72775514f02bca9960725d79676f26162472956faaa284b84cb2015821f50a78789d9f8103d6e2dbcbb046fd8a29239ccd6b032ed9b49ebc585bcfa89b5d0d686957cde86156d698008465adee01ce4bfd401acf4d3be0f16ca9734d0fd5ec8f38ed7b082f7deaa4162809a2eaeaf0da9061c6ad59396791f16fe05bda9afc67469913c02feb643e58ae5b6e6720ad02d5fcb27f4f3753a82780ded1eca0c144819005492b744fccb77c3e8adf019a6fc170da85f2024714d21c819870e268e6ea6e3ec528204d17fca01630a809834fb749d35049f646514d1104615a6a966a36f22f78bbe2c25f96bec0b2589782739c46df19e131665a367c62322f31402e83020222ef62b392f0bd9d44d1a9fe35d4d5613f9766a9f60c9452978b570373d566812f25acf6f6aabf60ba07074aab679750eb22c1b821a5016707853c8690682c0b5a605025843e7df61ac15318fa6577989cc20ac1d4949365d82ecdaed04ac1c993e6f0a9cfbfcbe4a752840a98ee9ba548fe1c67dc39b45896a459574b5ab2f748d8579bff5be15c7a3516c25a2607797af18be9183fa8cc14867cd5e0668b78ad01fcb9b598136b0490de2fd5cf382b5335e31a824f42258a21fd4887db4dda4614b5fb095a056fbc3e42b40dc927242e9a601bd8a52544cf159a00e1907561bd31fb44e163ff370a2837b5fbafb665135b3656ac78b9bc782d6971486ea090471f400594005498b0f30097233725672c62d1d3d1563b6d8e8a7052ac3b12ee54874f3a6c58c9675687797b36d40dc47c9dc28487d2202f4615a3b407fc7e1a84364d2e66a396757f3c98fbb6f9d25eedc9f2ffd850a0e36f6e38af8a71bb8c88c78da42146f10ccc4754e3d342df3074356ba8f582c024059c5cfc83358e1da81ee0f8328d7fb2e2c0c8f525b75de1d0fd7713f45b2a89f8d8427f2cb2f3f0dad1c723ea9da456bb1555c8d320805bc5e8e1ee255e0b617bda7d6e67c34b405bd01f8731aa58e5107512d8d9e9a2fb347f7b46ed793a604a563ba9fba7dce8541aff9f73860093acefc39dd5de43f4b0f484a36c6142d023abea7b368bb5ff9188aa020d29b7449c7ac8d932b9482683496754d8b181ed09925be7829276ea8f4cafe8cf716c6b15970ebf0af60e63374bcda0877e5c2ac2c11ee4b22803867f5f5f221b4693d388dd9716504edb98fbb59da865e306c8a5b17dc77eb8fcf44e507d84f096eee5b5196d6e8460d3fb23ef7083b1b5998897234bc8b839c40e55212c6252b4e37b2b0de608641b85793f6ad7019d34f486371f46585d51c3b7412123fb527251444b4cf03ce4a44a8fb2e5929cb77d037d8588c4251295ea1341b691b0aef143b3b3ffe5155c0268933e7738fcc0e603ef8a69cd5d328ce0ebd38c1b7ba2ced6b595611995d0022057d9df0318de1c53141929c5a4036157f0f6adae3a3c80cd476102dabf4b6fb6083574a22d51504e426599c34fb47f948f3a384571afdd213d2b4c4769b0a9b6a484f067888df5b63b81b097f04f7f57cc94338fae0486b56752f9761993688e16e1b5b50c9bd5030c01f14ee084f1df23b73cbb32a8b97cb6bca548a1fea42028571f234edb2b047c6f256c19aa974e28827229dddb7a1def10109f819cc6fd40ab18a6b33573e32991cfc2ee05e33509b08d983da433a974c3d01afc5230b0b1813421fb4cf355c1b284fc7bae9f30d2573f89b4e2a989cfc4d96c9768f1c55e49ad5f87336e15484f10fb684aea2010b11e6f6b894098e5af525ef2158f6eb1e94ba010d6cc58cf8dd8e04548c3f2fb28a103eeb583720e2a6ef199c583bc1dd9d79cd39848e14821df70428297af11d954fcd3d7a9355eb777719c38577ac80fb67f32eaea3d6b9466f642108d910abf8490db0f8e88622b444d6dce937408c119d6fc104657d9133d75ada448681f9e8bb8c23552199f86c9ca819acd17636c1f9093e32aa68549178dcb33748eaf740707f3c0489619137de47610b8fa86735013b05b38a5dfb02ef452aa9f4c7d9f0b3bc2f9c9476b0729e5133de17b31bf4d36fd21abfc4e25419799b54f25fe01feb811923ad80adb1ff280db819a53c1c8c33a6a7b3120f30fa225d12c001b80750fb13b16ea415636185f83cf64607b88200d9f7dc7d005f5aabc44d847b0d30c47f2822810a41b7d15c4e99253a5e0bb3dba6bb800f797ef94032eaf97fed36b884ac5dcfb944707f4cd45eb2aed891150bcb9da98bfc885d5a42919434e542a312100c19fd3cdadfcc64531e56beac29c6ff762a2a28cf0e950ce25836ab66f53137cde8db9dceefcc11c5b519d9441b9091384947f3849197f012e5d529cb19140700568d2d290813e74e91913a0dc9095e8778418caab6d34f667858eb903ff1737109ff8d9264788ba39b62d325518d797fdd5485d56096a041d04336d7a7fdfb79d61b8f46ee2963dd5787c1d254d943d96b6483047399c1829aa1dc6eaa59fb5876b423193913eebcf6dac34262945251f407b1018251d42b9d914ed13c6c54049f28ba11ff2fdecf489c8e4f40893e6d7e9c32818f8c3641a65aae46a702063f488c5d10386fcf5f30ee0ab32f2bbb9da254ba443703eb865fcdc0cf97dd9fd52c047112678eb3397cb2c99f43b08ee59902dacadf3458a382c0e0dedb152f26a70cd117d89aed48b425d415243ec5b5d26af984c307f58cb6d2bf1901591b348e34cf6aae652d77cf66c081be47b2aae71fd39c8d391cb06f4d89730b89f2370daaf5d18193cc76a7047a890ff105e8feab2354fd4ecd1225855b9eb174e2ab19c5b1128d8a4381c817052fe0d63095e23aad0813a150acb85ed8425190ddcd4b0cac615be4a5512b01d6dda9b00d75a671b7126e53cde374c0db770e8230e6c8b47a5f62c63febeea98612411e8703d9818cc38b8a74d11f38bc79d059acdbfe2c5e31a99d445fe6d2672a8a5da9c95157cd574285829f60e8e55bbe42ed2a31c7b82bda3f30e1cc577652c061c57c422c53dbce3bdc37b479e38e0e7bd30fefdabaac172ddd7dddd0dc94aa71c0bf36207bca581b85d6c8915c9ca9d08c856f26eb68c1a756a83b8f63c424dcf6c4c08abd2cc4e0f6b1acb4b973a3de53cca823eab368e19c3b171de9b339fb001c61366a04669e7614bd426b7fca37beeeb48c6a13110f04722c0ed9772f42bd2bf30d5a52ba8d9d2966e1d22e33e7e697230f53b51bfafff23de25ca14ba028461ec7a753349b5b1dba169206cf2d31177524042b8aea07595657f62d0478020e3b5e89eae61308003f15713e103c985d2f58d86afcff57dc58e11b0143143308307120c1db7b1fdef1c341118485a6208d8471066b3142896a242b47f000a4e121f2c94a7dbe6ade731b38b2bf247664950c3e52fbad0b24d442c9240"}) (async) syz_open_dev$sg(&(0x7f0000001140), 0x7, 0x84803) (async) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000001180)=0x1) (async) 10:01:51 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f6273a67ab0c351bc2eda6449ae9602546ca51db6938ca206000000b6bf8c6234ef8597f30876765649946be5b57a1ec12ab1f5464cbbc60ae1fb7e9d4c6150313fe87e8402000000575272574bb5725735fc819d6b5071993f49b60c33cd8e55e96647e133dea2b1266fc573915b742cdb93306040aff3f35723a3f8a316d7afeedd6cb9af8ee39f8b055e45c40f8dafc186027b91d23e519761ae76d9"], 0x16) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000000)=0x9) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000400), 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000003, 0x10, r4, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f00000004c0)={'ip6gre0\x00', &(0x7f0000000440)={'ip6_vti0\x00', r6, 0x29, 0x5, 0x2, 0x1f68, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x700, 0x2, 0x782}}) 10:01:51 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) (async) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x4d0480) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000001340)) (async) ioctl$SG_IO(r0, 0x2285, &(0x7f00000012c0)={0x0, 0xfffffffffffffffb, 0xaa, 0x7, @scatter={0x2, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000080)=""/45, 0x2d}, {&(0x7f00000000c0)=""/4096, 0x1000}]}, &(0x7f0000001100)="bc5c82e5ace17ee8d680a3aca463cf655ebddcde7ffcd6f35b395d0efd7f8db7470596648384a6c42b88e133ab50dfd6d15041882279eb0213fe10a16747f34ecc6698cde9090def486b16059559a15c74cd4a752906d9eccf0aab83b2d5c35063c2e169b9edc7b23aa4e1ed2641145e8d2831b3e0d5640953673d90790685141a29057a66b9768cad41c02e026d7a2e7b965e815e939d1ccc53312c98534a29a44c030496d02dd087fe", &(0x7f0000001380)=""/149, 0xc5f4, 0x1, 0x3, &(0x7f0000001280)}) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x404801) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_WRITE_FIXED={0x5, 0x2, 0x6000, @fd_index=0x2, 0x2, 0x2, 0x1f, 0xa, 0x0, {0x3}}, 0x1) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) write$P9_RREADLINK(r2, &(0x7f00000000c0)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f6273a67ab0c351bc2eda6449ae9602546ca51db6938ca206000000b6bf8c6234ef8597f30876765649946be5b57a1ec12ab1f5464cbbc60ae1fb7e9d4c6150313fe87e8402000000575272574bb5725735fc819d6b5071993f49b60c33cd8e55e96647e133dea2b1266fc573915b742cdb93306040aff3f35723a3f8a316d7afeedd6cb9af8ee39f8b055e45c40f8dafc186027b91d23e519761ae76d9"], 0x16) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000000)=0x9) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000400), 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000003, 0x10, r4, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f00000004c0)={'ip6gre0\x00', &(0x7f0000000440)={'ip6_vti0\x00', r6, 0x29, 0x5, 0x2, 0x1f68, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x700, 0x2, 0x782}}) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f6273a67ab0c351bc2eda6449ae9602546ca51db6938ca206000000b6bf8c6234ef8597f30876765649946be5b57a1ec12ab1f5464cbbc60ae1fb7e9d4c6150313fe87e8402000000575272574bb5725735fc819d6b5071993f49b60c33cd8e55e96647e133dea2b1266fc573915b742cdb93306040aff3f35723a3f8a316d7afeedd6cb9af8ee39f8b055e45c40f8dafc186027b91d23e519761ae76d9"], 0x16) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000000)=0x9) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000400), 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(0x0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000003, 0x10, r4, 0x0) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f00000004c0)={'ip6gre0\x00', &(0x7f0000000440)={'ip6_vti0\x00', r6, 0x29, 0x5, 0x2, 0x1f68, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x700, 0x2, 0x782}}) (async) 10:01:51 executing program 0: bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000001100)={0xffffffffffffffff}, 0x4) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x1000, 0x9, 0x3, "cef5d59a206b3b4c3acc254010a4b19ed2c86f21f05828e65589301f59f90ff17d8446c614b2cae394efb959c366a270e9259f7415d7e90167e076c77b786d35a3596c51d3a987e67194888a13f0101950d5efaeae00f3e0150e822a6aae644ace9f74bb269edf0eaece924e2e2b07eded19168aea6308c776e8194add6539e98f09445e84fcbac65036d6f2a9255db67a33da3ac39399e4b7db2f0e843d361c4d8d1d02ac0c462c2e06f63a2c15a06d8013f013350514cdd338a19b34385b5454dad992c35e649263a2b939066ae281d860bade77f5babf9a28572f2fef4f041b12d3361516bbd10db21b0557d7448b7bdc8add55f2436113f7bc93c7db1117f5d1de92c146689b567629ae4ea140d65ea9b0ba054a8586bc07b739bd40122d0392c6fb99fbfd8f1c572a2d85ecd8e5b4d29e319f43da0d89f9037715d5cd7f76716a439df9470075da21a8e444111be595830851fc171bcbf6c76da1ce2692945adadb8f157a7adf57873caf193ce9a1f928035cf8d0374cce649995425f2292f26e39b2aa25fddb335f062762e4f20ca9cdb99523fbc660b8dcb0cb066bf2514dd1dbf51165a8684e1b39c5d5113b87c0f4073bf3ef4ce9686663b211afffd4b3433b0202741a1206c4fc9ac0d08738689c3ec8781ba25576ee82291323cf30a5677042b032aa85f20f60b4be737d646f2c469427ca09311e9436fe910ec03420096bb060040cbf6dc2817678f2e5d995b9f95afeac6b69d45de2e5faa36142f3b69cceb558884c1f558e72b5c1cad123a3dced5c2e54cf28772a7e4da64b7e303fccb6972c09f422002c1836f564cd4f41dd9158a474a9a2ffc914007fe010ba2fa3748d4852e7f136d811526cf95b037bca34b7fbcf041077e136bf0aba6ee7c03db626db6527062828ff37b34847316784119bab8cdd52fadb7e9497874b79faa0621d0a6d5ae842f0a0dc20bbc741fb80dbe8f17bb7eb7985e8291fdfdbfb7b1ba51b019d1a7cb7958eb9ff9d19ea3d2e9f0ac9eb032b51a162d4aa5f907cc7203a823f6bd92b6997a787c99e020be02a04dc94e985b400939debdbc10b8272d853db54f80f2858c14c9efe8fd424343f71c42ed7446009f7bad1cd46bfb2277c58bf91100d230e634cc77b7bc2fdd22d918974f3b1a44f847dc2b9dcdda459b9f3a82d3b07ea2ece02c3d82128080d95bff9f84000b1b5c807294deb36abe10324faf3fbebd3514e6a54d7dd89c17535eefa1305599f2af418247f708c21ff14c6314717262f3dfccd0ea4bf8d0c195f809033655f2a7d3dfeccb72ab9b175047e589c2067fffbde1f90b07c1ccf824b9c7938d6632255e4bec76eb415a11d8b955663d0d23e28289f2413c0d903ffd71376534e6c7e164dd8eddc928f8824f0d8c408a51e6331790346c6b6085d355c4435499f23b5db359e13791bebd4e6d53c6985fd38a1eec569ae276381ff89aecc42273e61758c0bd2fc9ed34217603741e6df40de095da4b88a5805af5cf0f0f47461e686fca537777096ab21296d15dec333f9e5c0040443f1401e4c09ebeee1bdb15f599b212d6010830c423274bef6c306b8aec3322b41f90e2781efa53c01d0655dd049b536480db619d1405d44ea47826025af2d9da9daef519330feec70f48617409e59bc49745922f0ccd9cff7ad9928875f569573f4318479fb8f065c22cd45c367c80fde9e71c0374c72f6d8e5cc1fc79afa67362bc1c9b8906c5143912567e04a1f5ee7aadf82a89a41b5feeedb7a5494a715848b3623c3f60d358b8351e6f7183eb00e9bcd113002fe98794fa2a48766a67c11bfce405de754c2be2de43ce8b127d6ef898e025ffc1b2fcacee041bb180a1ac5d299b7bd804500410ad1e26c30aabf7862eae982767d2b7333e03a12ef944dbe410e99b6025471f172adb9aee654a1ef1fb34ba1bee23fc935b6c087b25d6dcb5f9f57317771e582249a4a19b7baecfd0e40ced9a96bfefb92e07280deac02fec3897816a36defcd5f3b34057434ab5f63b7ccf6ede9f2959e308d026f6d5b7f2296822afd6298c9f0ed9ada3c285ebec1df67305bfeb300501eb81814b53263b57cfb82ad8261f0ecea26bff28e138bb69b4debb7a533828ba94c971e46ed6c8b696c8ec2f9c24632533aa5d1d2a5e23cb5efd538fb8b8e28a4b9e5f2f65d41be18eae0b24e9b12b12506c7dc4a64447f73e4e27a73ea1822feb77a10d9c6fb034967065ed42ea51d1c4dc0d165e208a1642940e1701dc44ab0f0459ea9ae053e19f347b8d3c261bcd303f0ee243360385dfa6e9dd890db7670e55a9cacbd501682344b2b6cae81f074183513be2f696a32e26e92aeb2cb61657954765c72775514f02bca9960725d79676f26162472956faaa284b84cb2015821f50a78789d9f8103d6e2dbcbb046fd8a29239ccd6b032ed9b49ebc585bcfa89b5d0d686957cde86156d698008465adee01ce4bfd401acf4d3be0f16ca9734d0fd5ec8f38ed7b082f7deaa4162809a2eaeaf0da9061c6ad59396791f16fe05bda9afc67469913c02feb643e58ae5b6e6720ad02d5fcb27f4f3753a82780ded1eca0c144819005492b744fccb77c3e8adf019a6fc170da85f2024714d21c819870e268e6ea6e3ec528204d17fca01630a809834fb749d35049f646514d1104615a6a966a36f22f78bbe2c25f96bec0b2589782739c46df19e131665a367c62322f31402e83020222ef62b392f0bd9d44d1a9fe35d4d5613f9766a9f60c9452978b570373d566812f25acf6f6aabf60ba07074aab679750eb22c1b821a5016707853c8690682c0b5a605025843e7df61ac15318fa6577989cc20ac1d4949365d82ecdaed04ac1c993e6f0a9cfbfcbe4a752840a98ee9ba548fe1c67dc39b45896a459574b5ab2f748d8579bff5be15c7a3516c25a2607797af18be9183fa8cc14867cd5e0668b78ad01fcb9b598136b0490de2fd5cf382b5335e31a824f42258a21fd4887db4dda4614b5fb095a056fbc3e42b40dc927242e9a601bd8a52544cf159a00e1907561bd31fb44e163ff370a2837b5fbafb665135b3656ac78b9bc782d6971486ea090471f400594005498b0f30097233725672c62d1d3d1563b6d8e8a7052ac3b12ee54874f3a6c58c9675687797b36d40dc47c9dc28487d2202f4615a3b407fc7e1a84364d2e66a396757f3c98fbb6f9d25eedc9f2ffd850a0e36f6e38af8a71bb8c88c78da42146f10ccc4754e3d342df3074356ba8f582c024059c5cfc83358e1da81ee0f8328d7fb2e2c0c8f525b75de1d0fd7713f45b2a89f8d8427f2cb2f3f0dad1c723ea9da456bb1555c8d320805bc5e8e1ee255e0b617bda7d6e67c34b405bd01f8731aa58e5107512d8d9e9a2fb347f7b46ed793a604a563ba9fba7dce8541aff9f73860093acefc39dd5de43f4b0f484a36c6142d023abea7b368bb5ff9188aa020d29b7449c7ac8d932b9482683496754d8b181ed09925be7829276ea8f4cafe8cf716c6b15970ebf0af60e63374bcda0877e5c2ac2c11ee4b22803867f5f5f221b4693d388dd9716504edb98fbb59da865e306c8a5b17dc77eb8fcf44e507d84f096eee5b5196d6e8460d3fb23ef7083b1b5998897234bc8b839c40e55212c6252b4e37b2b0de608641b85793f6ad7019d34f486371f46585d51c3b7412123fb527251444b4cf03ce4a44a8fb2e5929cb77d037d8588c4251295ea1341b691b0aef143b3b3ffe5155c0268933e7738fcc0e603ef8a69cd5d328ce0ebd38c1b7ba2ced6b595611995d0022057d9df0318de1c53141929c5a4036157f0f6adae3a3c80cd476102dabf4b6fb6083574a22d51504e426599c34fb47f948f3a384571afdd213d2b4c4769b0a9b6a484f067888df5b63b81b097f04f7f57cc94338fae0486b56752f9761993688e16e1b5b50c9bd5030c01f14ee084f1df23b73cbb32a8b97cb6bca548a1fea42028571f234edb2b047c6f256c19aa974e28827229dddb7a1def10109f819cc6fd40ab18a6b33573e32991cfc2ee05e33509b08d983da433a974c3d01afc5230b0b1813421fb4cf355c1b284fc7bae9f30d2573f89b4e2a989cfc4d96c9768f1c55e49ad5f87336e15484f10fb684aea2010b11e6f6b894098e5af525ef2158f6eb1e94ba010d6cc58cf8dd8e04548c3f2fb28a103eeb583720e2a6ef199c583bc1dd9d79cd39848e14821df70428297af11d954fcd3d7a9355eb777719c38577ac80fb67f32eaea3d6b9466f642108d910abf8490db0f8e88622b444d6dce937408c119d6fc104657d9133d75ada448681f9e8bb8c23552199f86c9ca819acd17636c1f9093e32aa68549178dcb33748eaf740707f3c0489619137de47610b8fa86735013b05b38a5dfb02ef452aa9f4c7d9f0b3bc2f9c9476b0729e5133de17b31bf4d36fd21abfc4e25419799b54f25fe01feb811923ad80adb1ff280db819a53c1c8c33a6a7b3120f30fa225d12c001b80750fb13b16ea415636185f83cf64607b88200d9f7dc7d005f5aabc44d847b0d30c47f2822810a41b7d15c4e99253a5e0bb3dba6bb800f797ef94032eaf97fed36b884ac5dcfb944707f4cd45eb2aed891150bcb9da98bfc885d5a42919434e542a312100c19fd3cdadfcc64531e56beac29c6ff762a2a28cf0e950ce25836ab66f53137cde8db9dceefcc11c5b519d9441b9091384947f3849197f012e5d529cb19140700568d2d290813e74e91913a0dc9095e8778418caab6d34f667858eb903ff1737109ff8d9264788ba39b62d325518d797fdd5485d56096a041d04336d7a7fdfb79d61b8f46ee2963dd5787c1d254d943d96b6483047399c1829aa1dc6eaa59fb5876b423193913eebcf6dac34262945251f407b1018251d42b9d914ed13c6c54049f28ba11ff2fdecf489c8e4f40893e6d7e9c32818f8c3641a65aae46a702063f488c5d10386fcf5f30ee0ab32f2bbb9da254ba443703eb865fcdc0cf97dd9fd52c047112678eb3397cb2c99f43b08ee59902dacadf3458a382c0e0dedb152f26a70cd117d89aed48b425d415243ec5b5d26af984c307f58cb6d2bf1901591b348e34cf6aae652d77cf66c081be47b2aae71fd39c8d391cb06f4d89730b89f2370daaf5d18193cc76a7047a890ff105e8feab2354fd4ecd1225855b9eb174e2ab19c5b1128d8a4381c817052fe0d63095e23aad0813a150acb85ed8425190ddcd4b0cac615be4a5512b01d6dda9b00d75a671b7126e53cde374c0db770e8230e6c8b47a5f62c63febeea98612411e8703d9818cc38b8a74d11f38bc79d059acdbfe2c5e31a99d445fe6d2672a8a5da9c95157cd574285829f60e8e55bbe42ed2a31c7b82bda3f30e1cc577652c061c57c422c53dbce3bdc37b479e38e0e7bd30fefdabaac172ddd7dddd0dc94aa71c0bf36207bca581b85d6c8915c9ca9d08c856f26eb68c1a756a83b8f63c424dcf6c4c08abd2cc4e0f6b1acb4b973a3de53cca823eab368e19c3b171de9b339fb001c61366a04669e7614bd426b7fca37beeeb48c6a13110f04722c0ed9772f42bd2bf30d5a52ba8d9d2966e1d22e33e7e697230f53b51bfafff23de25ca14ba028461ec7a753349b5b1dba169206cf2d31177524042b8aea07595657f62d0478020e3b5e89eae61308003f15713e103c985d2f58d86afcff57dc58e11b0143143308307120c1db7b1fdef1c341118485a6208d8471066b3142896a242b47f000a4e121f2c94a7dbe6ade731b38b2bf247664950c3e52fbad0b24d442c9240"}) r2 = syz_open_dev$sg(&(0x7f0000001140), 0x7, 0x84803) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000001180)=0x1) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f00000001c0)={0x53, 0xffffffffffffffff, 0x62, 0x0, @buffer={0x0, 0x2a, &(0x7f0000000080)=""/42}, &(0x7f00000000c0)="24de79e958af4f042afa4e5a2ab26092118506b11917d8d8af4b4cb68fa8d17cb431dd854f8fb34fb2467eac7e9e0f3f888c0ec87b3323cf336ab940802dad71f7fc1a4813f31fd1918a8cbfeb711e95f0282628d7d8a8da498921b6d26d8b226584", &(0x7f0000000140), 0x9, 0x11, 0x1, &(0x7f0000000180)}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x20010, r3, 0x8000000) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x404801) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:51 executing program 5: ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000080)=0x9c) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x400, 0xa201) r0 = syz_open_dev$sg(&(0x7f0000000100), 0x2, 0x28280) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f00000000c0)) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000180)) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={0xffffffffffffffff}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={0x0, @broadcast, @dev}, &(0x7f0000000140)=0xc) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f00000001c0)={0x53, 0xffffffffffffffff, 0x62, 0x0, @buffer={0x0, 0x2a, &(0x7f0000000080)=""/42}, &(0x7f00000000c0)="24de79e958af4f042afa4e5a2ab26092118506b11917d8d8af4b4cb68fa8d17cb431dd854f8fb34fb2467eac7e9e0f3f888c0ec87b3323cf336ab940802dad71f7fc1a4813f31fd1918a8cbfeb711e95f0282628d7d8a8da498921b6d26d8b226584", &(0x7f0000000140), 0x9, 0x11, 0x1, &(0x7f0000000180)}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x20010, r3, 0x8000000) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_IO(r2, 0x2285, &(0x7f00000001c0)={0x53, 0xffffffffffffffff, 0x62, 0x0, @buffer={0x0, 0x2a, &(0x7f0000000080)=""/42}, &(0x7f00000000c0)="24de79e958af4f042afa4e5a2ab26092118506b11917d8d8af4b4cb68fa8d17cb431dd854f8fb34fb2467eac7e9e0f3f888c0ec87b3323cf336ab940802dad71f7fc1a4813f31fd1918a8cbfeb711e95f0282628d7d8a8da498921b6d26d8b226584", &(0x7f0000000140), 0x9, 0x11, 0x1, &(0x7f0000000180)}) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x20010, r3, 0x8000000) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) 10:01:51 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f6273a67ab0c351bc2eda6449ae9602546ca51db6938ca206000000b6bf8c6234ef8597f30876765649946be5b57a1ec12ab1f5464cbbc60ae1fb7e9d4c6150313fe87e8402000000575272574bb5725735fc819d6b5071993f49b60c33cd8e55e96647e133dea2b1266fc573915b742cdb93306040aff3f35723a3f8a316d7afeedd6cb9af8ee39f8b055e45c40f8dafc186027b91d23e519761ae76d9"], 0x16) (async, rerun: 32) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async, rerun: 32) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000000)=0x9) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000400), 0x0, 0x4) (async, rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) (async, rerun: 64) r4 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000003, 0x10, r4, 0x0) (async) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f00000004c0)={'ip6gre0\x00', &(0x7f0000000440)={'ip6_vti0\x00', r6, 0x29, 0x5, 0x2, 0x1f68, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x700, 0x2, 0x782}}) 10:01:51 executing program 5: ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000080)=0x9c) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x400, 0xa201) r0 = syz_open_dev$sg(&(0x7f0000000100), 0x2, 0x28280) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f00000000c0)) 10:01:51 executing program 0: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000080)) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000100)=ANY=[@ANYBLOB="4d000000000000000000000000000000000000000000000000000000000000000000000000000000000000e18b99378feae3ad457300"/81]) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000400)={0x1, 'netdevsim0\x00', {}, 0x2}) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x20000010}, 0x81c) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000180)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (rerun: 32) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_IO(r2, 0x2285, &(0x7f00000001c0)={0x53, 0xffffffffffffffff, 0x62, 0x0, @buffer={0x0, 0x2a, &(0x7f0000000080)=""/42}, &(0x7f00000000c0)="24de79e958af4f042afa4e5a2ab26092118506b11917d8d8af4b4cb68fa8d17cb431dd854f8fb34fb2467eac7e9e0f3f888c0ec87b3323cf336ab940802dad71f7fc1a4813f31fd1918a8cbfeb711e95f0282628d7d8a8da498921b6d26d8b226584", &(0x7f0000000140), 0x9, 0x11, 0x1, &(0x7f0000000180)}) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x20010, r3, 0x8000000) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000180)) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={0xffffffffffffffff}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={0x0, @broadcast, @dev}, &(0x7f0000000140)=0xc) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000180)) (async) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) (async) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)) (async) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={0x0, @broadcast, @dev}, &(0x7f0000000140)=0xc) (async) 10:01:51 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x531001, 0x0) socketpair(0x26, 0x4, 0x4, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000080)={0x7}) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:51 executing program 5: ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000080)=0x9c) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) syz_open_dev$sg(&(0x7f0000000000), 0x400, 0xa201) (rerun: 64) r0 = syz_open_dev$sg(&(0x7f0000000100), 0x2, 0x28280) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f00000000c0)) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) syz_io_uring_complete(0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x0, &(0x7f0000000080)=0x1, 0x0, 0x4) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (rerun: 64) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000180)) (async) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) (async) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={0xffffffffffffffff}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={0x0, @broadcast, @dev}, &(0x7f0000000140)=0xc) 10:01:51 executing program 0: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000080)) (async, rerun: 64) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000100)=ANY=[@ANYBLOB="4d000000000000000000000000000000000000000000000000000000000000000000000000000000000000e18b99378feae3ad457300"/81]) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000400)={0x1, 'netdevsim0\x00', {}, 0x2}) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) (async) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x20000010}, 0x81c) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000180)) (async, rerun: 64) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (rerun: 64) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) syz_io_uring_complete(0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x0, &(0x7f0000000080)=0x1, 0x0, 0x4) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000080)=0x1) 10:01:51 executing program 0: ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000080)) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000100)=ANY=[@ANYBLOB="4d000000000000000000000000000000000000000000000000000000000000000000000000000000000000e18b99378feae3ad457300"/81]) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000400)={0x1, 'netdevsim0\x00', {}, 0x2}) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x20000010}, 0x81c) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000180)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000080)) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) (async) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000100)=ANY=[@ANYBLOB="4d000000000000000000000000000000000000000000000000000000000000000000000000000000000000e18b99378feae3ad457300"/81]) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000400)={0x1, 'netdevsim0\x00', {}, 0x2}) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r4) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x20000010}, 0x81c) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000180)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000080)=0x1) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000080)=0x1) (async) 10:01:51 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x531001, 0x0) (async) socketpair(0x26, 0x4, 0x4, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000080)={0x7}) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) (async) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) syz_io_uring_complete(0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x0, &(0x7f0000000080)=0x1, 0x0, 0x4) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) syz_io_uring_complete(0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x0, &(0x7f0000000080)=0x1, 0x0, 0x4) (async) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x1, 0x541080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000100)=0x67) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f00000000c0)=0x2f) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000080)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f0000000180)=@newtaction={0x5b4, 0x30, 0x400, 0x70bd26, 0x25dfdbff, {}, [{0x5a0, 0x1, [@m_xt={0x288, 0x18, 0x0, 0x0, {{0x7}, {0x254, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x5}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}, @TCA_IPT_HOOK={0x8, 0x2, 0x1}, @TCA_IPT_TARG={0xa6, 0x6, {0x0, 'filter\x00', 0x80, 0x48, "0808489d7f0799a53cc996b4d0c382f11765ef715526f59d02b142c49f3c87543db8700126600899cf9118e9e49482d2fc1b0152c0690ed7a66bae56f3852935b9a16f270e18c3cbd99caf259aa18a6f54eb04f9badf1041aed8a5f128d483f24398a7f6b6ae02f5aaad3e79d50fc22047578371104dec51bb408882"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x1}, @TCA_IPT_TARG={0xde, 0x6, {0x6, 'filter\x00', 0xfc, 0x76, "29b50639a9f6b1500dff2fe786477e941ef19f5fe90dccde447b202c397babe8f1dd3a4282428e4b8beb6b802faafa7126d9e14e8924ffdcac96b6e7e6f617b2a23cb506b75dde0fa8421229c105992a4b179f6871b743c856a1afe3bc1493c2d2631f4cfc8e17ba91374c58544273b9e14646b58a79fb2afda3853b3333070fd926825a1cdfb697b1e717b39eb17ae318c74703c78bb5883cac6b3180bcc3ac0cfdf4b78e2d81ae28d7e01c4f77b3c25d21e030"}}, @TCA_IPT_TARG={0xa6, 0x6, {0x8, 'mangle\x00', 0x7, 0x8001, "63f0beebb71094516fc3eb5fbb74fb3cfd139c1717de5cedc6e69ea086beac53cf52d8e8477f83d90137a4df3cba000fcb9bb74fe625d8af651aabc02a0a0a297f0a549bee57d7f9a651c0cb8ca9deecc7cb8ea73cadeecc05606348da0d49bc540a6bb600b027aec529cd1200b8a442291971632975c2fb538244d1"}}]}, {0xe, 0x6, "a33c99eb9070fcda7f79"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}, @m_xt={0x150, 0x1e, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'mangle\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}]}, {0xf9, 0x6, "d21921e98347db08133f31438f3eaf83107fe41f28eea2d3e3e523ac1e6dc7b03902f1063ca666537b1400b27ece2aacd28ae65ced695259f0ab4b409c73e5fd625e1c35e7a9f745d25b69719ca1bffe143961af8eb32ddacc8761da98dd2a281ee45e832883d5fd4907a51b14150f03e45f1a954ac6fdc8227ad5b20e2551d5a276cd8451e9eb68a11522848f3191bbcca1f7bc724138a909dabea317de8cf537a82b3ce3e1e12e30de001eb0d964a9f94571103057654ef2c91af38bcf86ea4efed2b6c976032d18cacaac2feba0ae3cbcb52c556f6de3113b417a2997b5e465f7357bd1eb0ae23e50a1b2e0ebfcf5425be4af9e"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_skbedit={0xe4, 0xc, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x8}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xfff1, 0x8}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0xffc0}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x9}]}, {0x98, 0x6, "b5f43a89e996f24aca97df3088d86350114fbafc9dc659ab96257f7fe43c52c72f267b0b6d0d564f9173f3a34ad2a6de176d8c0eda90270a624ee93f8de463add6b24e3fb5a8423c85600da58a3e3cf61a3ae1adb9fa5e18ed5890eff71262bb904649db9e2a28ba03e4b34ee1606708510ca0b295a79c6abc4eb5dca50e63b743098e7c12a4b979a8f5b8a773b6dd7d1d320ddf"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_tunnel_key={0xe0, 0xb, 0x0, 0x0, {{0xf}, {0x1c, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_NO_CSUM={0x5}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}]}, {0x97, 0x6, "a7ab28451045535e32276b44359ba6bfbce049381a82aa8a7d621fd49dc9336bcd79d5a1ceda16c350b1c70523f434dda9bc33215ccf28708621e2b91aab3a7bbeecdb81fc63fddaff383bf8380718d84e76030d07c4ac0575758d5af3a90db7b0524a023a99996f5518f26ad0e7c1428852d888400b3cee72209638b9da4deef7b34037bde743cee42b2665d074867565a4cd"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x5b4}, 0x1, 0x0, 0x0, 0x4000}, 0x4004080) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f0000000080)=0x1) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x1, 0x541080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000100)=0x67) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f00000000c0)=0x2f) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000080)) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f0000000180)=@newtaction={0x5b4, 0x30, 0x400, 0x70bd26, 0x25dfdbff, {}, [{0x5a0, 0x1, [@m_xt={0x288, 0x18, 0x0, 0x0, {{0x7}, {0x254, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x5}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}, @TCA_IPT_HOOK={0x8, 0x2, 0x1}, @TCA_IPT_TARG={0xa6, 0x6, {0x0, 'filter\x00', 0x80, 0x48, "0808489d7f0799a53cc996b4d0c382f11765ef715526f59d02b142c49f3c87543db8700126600899cf9118e9e49482d2fc1b0152c0690ed7a66bae56f3852935b9a16f270e18c3cbd99caf259aa18a6f54eb04f9badf1041aed8a5f128d483f24398a7f6b6ae02f5aaad3e79d50fc22047578371104dec51bb408882"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x1}, @TCA_IPT_TARG={0xde, 0x6, {0x6, 'filter\x00', 0xfc, 0x76, "29b50639a9f6b1500dff2fe786477e941ef19f5fe90dccde447b202c397babe8f1dd3a4282428e4b8beb6b802faafa7126d9e14e8924ffdcac96b6e7e6f617b2a23cb506b75dde0fa8421229c105992a4b179f6871b743c856a1afe3bc1493c2d2631f4cfc8e17ba91374c58544273b9e14646b58a79fb2afda3853b3333070fd926825a1cdfb697b1e717b39eb17ae318c74703c78bb5883cac6b3180bcc3ac0cfdf4b78e2d81ae28d7e01c4f77b3c25d21e030"}}, @TCA_IPT_TARG={0xa6, 0x6, {0x8, 'mangle\x00', 0x7, 0x8001, "63f0beebb71094516fc3eb5fbb74fb3cfd139c1717de5cedc6e69ea086beac53cf52d8e8477f83d90137a4df3cba000fcb9bb74fe625d8af651aabc02a0a0a297f0a549bee57d7f9a651c0cb8ca9deecc7cb8ea73cadeecc05606348da0d49bc540a6bb600b027aec529cd1200b8a442291971632975c2fb538244d1"}}]}, {0xe, 0x6, "a33c99eb9070fcda7f79"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}, @m_xt={0x150, 0x1e, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'mangle\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}]}, {0xf9, 0x6, "d21921e98347db08133f31438f3eaf83107fe41f28eea2d3e3e523ac1e6dc7b03902f1063ca666537b1400b27ece2aacd28ae65ced695259f0ab4b409c73e5fd625e1c35e7a9f745d25b69719ca1bffe143961af8eb32ddacc8761da98dd2a281ee45e832883d5fd4907a51b14150f03e45f1a954ac6fdc8227ad5b20e2551d5a276cd8451e9eb68a11522848f3191bbcca1f7bc724138a909dabea317de8cf537a82b3ce3e1e12e30de001eb0d964a9f94571103057654ef2c91af38bcf86ea4efed2b6c976032d18cacaac2feba0ae3cbcb52c556f6de3113b417a2997b5e465f7357bd1eb0ae23e50a1b2e0ebfcf5425be4af9e"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_skbedit={0xe4, 0xc, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x8}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xfff1, 0x8}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0xffc0}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x9}]}, {0x98, 0x6, "b5f43a89e996f24aca97df3088d86350114fbafc9dc659ab96257f7fe43c52c72f267b0b6d0d564f9173f3a34ad2a6de176d8c0eda90270a624ee93f8de463add6b24e3fb5a8423c85600da58a3e3cf61a3ae1adb9fa5e18ed5890eff71262bb904649db9e2a28ba03e4b34ee1606708510ca0b295a79c6abc4eb5dca50e63b743098e7c12a4b979a8f5b8a773b6dd7d1d320ddf"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_tunnel_key={0xe0, 0xb, 0x0, 0x0, {{0xf}, {0x1c, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_NO_CSUM={0x5}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}]}, {0x97, 0x6, "a7ab28451045535e32276b44359ba6bfbce049381a82aa8a7d621fd49dc9336bcd79d5a1ceda16c350b1c70523f434dda9bc33215ccf28708621e2b91aab3a7bbeecdb81fc63fddaff383bf8380718d84e76030d07c4ac0575758d5af3a90db7b0524a023a99996f5518f26ad0e7c1428852d888400b3cee72209638b9da4deef7b34037bde743cee42b2665d074867565a4cd"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x5b4}, 0x1, 0x0, 0x0, 0x4000}, 0x4004080) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000080)) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x478d02) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:51 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x531001, 0x0) socketpair(0x26, 0x4, 0x4, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000080)={0x7}) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x531001, 0x0) (async) socketpair(0x26, 0x4, 0x4, &(0x7f0000000040)) (async) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000080)={0x7}) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x478d02) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000080)) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x1, 0x541080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000100)=0x67) (async) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f00000000c0)=0x2f) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000080)) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f0000000180)=@newtaction={0x5b4, 0x30, 0x400, 0x70bd26, 0x25dfdbff, {}, [{0x5a0, 0x1, [@m_xt={0x288, 0x18, 0x0, 0x0, {{0x7}, {0x254, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x5}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}, @TCA_IPT_HOOK={0x8, 0x2, 0x1}, @TCA_IPT_TARG={0xa6, 0x6, {0x0, 'filter\x00', 0x80, 0x48, "0808489d7f0799a53cc996b4d0c382f11765ef715526f59d02b142c49f3c87543db8700126600899cf9118e9e49482d2fc1b0152c0690ed7a66bae56f3852935b9a16f270e18c3cbd99caf259aa18a6f54eb04f9badf1041aed8a5f128d483f24398a7f6b6ae02f5aaad3e79d50fc22047578371104dec51bb408882"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x1}, @TCA_IPT_TARG={0xde, 0x6, {0x6, 'filter\x00', 0xfc, 0x76, "29b50639a9f6b1500dff2fe786477e941ef19f5fe90dccde447b202c397babe8f1dd3a4282428e4b8beb6b802faafa7126d9e14e8924ffdcac96b6e7e6f617b2a23cb506b75dde0fa8421229c105992a4b179f6871b743c856a1afe3bc1493c2d2631f4cfc8e17ba91374c58544273b9e14646b58a79fb2afda3853b3333070fd926825a1cdfb697b1e717b39eb17ae318c74703c78bb5883cac6b3180bcc3ac0cfdf4b78e2d81ae28d7e01c4f77b3c25d21e030"}}, @TCA_IPT_TARG={0xa6, 0x6, {0x8, 'mangle\x00', 0x7, 0x8001, "63f0beebb71094516fc3eb5fbb74fb3cfd139c1717de5cedc6e69ea086beac53cf52d8e8477f83d90137a4df3cba000fcb9bb74fe625d8af651aabc02a0a0a297f0a549bee57d7f9a651c0cb8ca9deecc7cb8ea73cadeecc05606348da0d49bc540a6bb600b027aec529cd1200b8a442291971632975c2fb538244d1"}}]}, {0xe, 0x6, "a33c99eb9070fcda7f79"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}, @m_xt={0x150, 0x1e, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'mangle\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x3}]}, {0xf9, 0x6, "d21921e98347db08133f31438f3eaf83107fe41f28eea2d3e3e523ac1e6dc7b03902f1063ca666537b1400b27ece2aacd28ae65ced695259f0ab4b409c73e5fd625e1c35e7a9f745d25b69719ca1bffe143961af8eb32ddacc8761da98dd2a281ee45e832883d5fd4907a51b14150f03e45f1a954ac6fdc8227ad5b20e2551d5a276cd8451e9eb68a11522848f3191bbcca1f7bc724138a909dabea317de8cf537a82b3ce3e1e12e30de001eb0d964a9f94571103057654ef2c91af38bcf86ea4efed2b6c976032d18cacaac2feba0ae3cbcb52c556f6de3113b417a2997b5e465f7357bd1eb0ae23e50a1b2e0ebfcf5425be4af9e"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_skbedit={0xe4, 0xc, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x5, 0x8}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xfff1, 0x8}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0xffc0}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x9}]}, {0x98, 0x6, "b5f43a89e996f24aca97df3088d86350114fbafc9dc659ab96257f7fe43c52c72f267b0b6d0d564f9173f3a34ad2a6de176d8c0eda90270a624ee93f8de463add6b24e3fb5a8423c85600da58a3e3cf61a3ae1adb9fa5e18ed5890eff71262bb904649db9e2a28ba03e4b34ee1606708510ca0b295a79c6abc4eb5dca50e63b743098e7c12a4b979a8f5b8a773b6dd7d1d320ddf"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_tunnel_key={0xe0, 0xb, 0x0, 0x0, {{0xf}, {0x1c, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_NO_CSUM={0x5}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}]}, {0x97, 0x6, "a7ab28451045535e32276b44359ba6bfbce049381a82aa8a7d621fd49dc9336bcd79d5a1ceda16c350b1c70523f434dda9bc33215ccf28708621e2b91aab3a7bbeecdb81fc63fddaff383bf8380718d84e76030d07c4ac0575758d5af3a90db7b0524a023a99996f5518f26ad0e7c1428852d888400b3cee72209638b9da4deef7b34037bde743cee42b2665d074867565a4cd"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x5b4}, 0x1, 0x0, 0x0, 0x4000}, 0x4004080) 10:01:51 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r1, 0x1}, 0x14}}, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'ip6gre0\x00', 0x0, 0x2f, 0x4, 0x1, 0x10000, 0x42, @dev={0xfe, 0x80, '\x00', 0x2b}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8, 0x20, 0xfffffffd, 0x20}}) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, r1, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_LINK={0x8, 0x1, r4}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010100}, @GTPA_MS_ADDRESS={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010100}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x8004}, 0x4000080) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x80) ioctl$SG_GET_NUM_WAITING(r5, 0x2201, &(0x7f0000000000)) ioctl$SCSI_IOCTL_START_UNIT(r5, 0x5) 10:01:51 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000080)) 10:01:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r1, 0x1}, 0x14}}, 0x0) (async) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'ip6gre0\x00', 0x0, 0x2f, 0x4, 0x1, 0x10000, 0x42, @dev={0xfe, 0x80, '\x00', 0x2b}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8, 0x20, 0xfffffffd, 0x20}}) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, r1, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_LINK={0x8, 0x1, r4}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010100}, @GTPA_MS_ADDRESS={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010100}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x8004}, 0x4000080) (async) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x80) ioctl$SG_GET_NUM_WAITING(r5, 0x2201, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_START_UNIT(r5, 0x5) 10:01:51 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) (async) 10:01:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x478d02) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:51 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000080)) 10:01:51 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r1, 0x1}, 0x14}}, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'ip6gre0\x00', 0x0, 0x2f, 0x4, 0x1, 0x10000, 0x42, @dev={0xfe, 0x80, '\x00', 0x2b}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8, 0x20, 0xfffffffd, 0x20}}) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, r1, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_LINK={0x8, 0x1, r4}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_LINK={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010100}, @GTPA_MS_ADDRESS={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @GTPA_O_TEI={0x8, 0x9, 0x3}, @GTPA_MS_ADDRESS={0x8, 0x5, @rand_addr=0x64010100}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x8004}, 0x4000080) (async) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x80) ioctl$SG_GET_NUM_WAITING(r5, 0x2201, &(0x7f0000000000)) ioctl$SCSI_IOCTL_START_UNIT(r5, 0x5) 10:01:51 executing program 3: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r0 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_io_uring_complete(r0) write$P9_RLERRORu(r1, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xfffffffd}}, 0x16) 10:01:51 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x14000) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000080)) 10:01:51 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000080)) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x80000001, 0x4ce802) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x29, 0x2, 0x3f, 0x10000, 0x10, @loopback, @empty, 0x1, 0x1, 0x1, 0xffffffff}}) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f00000006c0)={0x20, 0x0, 0x220, 0x70bd2d, 0x25dfdbfd, {}, [{{0x8}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x200400c0}, 0x80) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r4 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r4, 0x0, 0x481, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="acdaa183f95e", 0x6}, {&(0x7f00000000c0)="df44137532bb2b1547300b7cfabf162421a0d16770254871c6b4b39f", 0x1c}], 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="072bd6fc3331b1b208c5ff72a347ef99d803e3f5e825dc84c36cad5435fc2da7fe6e3c9a25bb8021da5ac6b5c86b734b911fc21489149567e5"], 0x90}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r6, 0x1}, 0x14}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x5e94cdce0ea3c3be, 0x1f, 0x7, 0x5, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2, 0x10, 0x0, 0x7, 0x1}}) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r6, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @loopback}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x3c}}, 0x0) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x80000001, 0x4ce802) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:51 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000080)) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000080)) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x29, 0x2, 0x3f, 0x10000, 0x10, @loopback, @empty, 0x1, 0x1, 0x1, 0xffffffff}}) (async) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f00000006c0)={0x20, 0x0, 0x220, 0x70bd2d, 0x25dfdbfd, {}, [{{0x8}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x200400c0}, 0x80) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r4 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r4, 0x0, 0x481, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="acdaa183f95e", 0x6}, {&(0x7f00000000c0)="df44137532bb2b1547300b7cfabf162421a0d16770254871c6b4b39f", 0x1c}], 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="072bd6fc3331b1b208c5ff72a347ef99d803e3f5e825dc84c36cad5435fc2da7fe6e3c9a25bb8021da5ac6b5c86b734b911fc21489149567e5"], 0x90}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r6, 0x1}, 0x14}}, 0x0) (async) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x5e94cdce0ea3c3be, 0x1f, 0x7, 0x5, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2, 0x10, 0x0, 0x7, 0x1}}) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r6, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @loopback}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x3c}}, 0x0) 10:01:51 executing program 3: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r0 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_io_uring_complete(r0) write$P9_RLERRORu(r1, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xfffffffd}}, 0x16) 10:01:51 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x14000) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async, rerun: 32) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async, rerun: 32) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async, rerun: 64) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) (async) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x80000001, 0x4ce802) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000080)) 10:01:51 executing program 3: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) r0 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x30, 0xffffffffffffffff, 0x8000000) r1 = syz_io_uring_complete(r0) write$P9_RLERRORu(r1, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '\x00\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xfffffffd}}, 0x16) 10:01:51 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x5, 0x14000) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) (async) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) 10:01:51 executing program 4: socket$pppl2tp(0x18, 0x1, 0x1) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x220200) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:51 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x29, 0x2, 0x3f, 0x10000, 0x10, @loopback, @empty, 0x1, 0x1, 0x1, 0xffffffff}}) (async) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f00000006c0)={0x20, 0x0, 0x220, 0x70bd2d, 0x25dfdbfd, {}, [{{0x8}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x200400c0}, 0x80) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r4 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r4, 0x0, 0x481, 0x0, 0x0) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="acdaa183f95e", 0x6}, {&(0x7f00000000c0)="df44137532bb2b1547300b7cfabf162421a0d16770254871c6b4b39f", 0x1c}], 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="072bd6fc3331b1b208c5ff72a347ef99d803e3f5e825dc84c36cad5435fc2da7fe6e3c9a25bb8021da5ac6b5c86b734b911fc21489149567e5"], 0x90}, 0x80) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r6, 0x1}, 0x14}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x5e94cdce0ea3c3be, 0x1f, 0x7, 0x5, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2, 0x10, 0x0, 0x7, 0x1}}) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r6, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @loopback}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x3c}}, 0x0) 10:01:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x946a8b4523aef053, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657477315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e300000000000000000090049e23a2e8d33910400000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x4, 0x80, 0x3, 0x896, 0x10, @dev={0xfe, 0x80, '\x00', 0x2e}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x80, 0x1, 0x8000, 0x4c3c73e3}}) sendmsg$nl_route(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@bridge_delvlan={0x38, 0x71, 0x100, 0x70bd25, 0x25dfdbfd, {0x7, 0x0, 0x0, r4}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_ID={0x8, 0x1, 0x3}}}, @BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8, 0x2, 0x13}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x40000) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x9a, 0x40000) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:52 executing program 4: socket$pppl2tp(0x18, 0x1, 0x1) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x220200) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:52 executing program 5: syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), 0xffffffffffffffff) ioctl$SCSI_IOCTL_STOP_UNIT(0xffffffffffffffff, 0x6) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x414000) r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x1000, 0x111040) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000100)) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_LISTDEF(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008044}, 0x4004041) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000000, 0x10, r2, 0x8000000) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x24044014}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) write$P9_RLERRORu(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="160004960702000000274cd330699ee6e6d100ab4c00"], 0x16) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='ev/bsg\x00'/22], 0x87ffff2) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x946a8b4523aef053, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async, rerun: 32) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657477315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e300000000000000000090049e23a2e8d33910400000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x4, 0x80, 0x3, 0x896, 0x10, @dev={0xfe, 0x80, '\x00', 0x2e}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x80, 0x1, 0x8000, 0x4c3c73e3}}) sendmsg$nl_route(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@bridge_delvlan={0x38, 0x71, 0x100, 0x70bd25, 0x25dfdbfd, {0x7, 0x0, 0x0, r4}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_ID={0x8, 0x1, 0x3}}}, @BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8, 0x2, 0x13}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x40000) (async) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:52 executing program 4: socket$pppl2tp(0x18, 0x1, 0x1) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x220200) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) socket$pppl2tp(0x18, 0x1, 0x1) (async) syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x220200) (async) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x9a, 0x40000) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:52 executing program 5: syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), 0xffffffffffffffff) ioctl$SCSI_IOCTL_STOP_UNIT(0xffffffffffffffff, 0x6) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x414000) r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x1000, 0x111040) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000100)) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_LISTDEF(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008044}, 0x4004041) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$SCSI_IOCTL_STOP_UNIT(0xffffffffffffffff, 0x6) (async) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x414000) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x1000, 0x111040) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000100)) (async) socket$pptp(0x18, 0x1, 0x2) (async) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_MGMT_C_LISTDEF(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008044}, 0x4004041) (async) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x946a8b4523aef053, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async, rerun: 64) r3 = syz_io_uring_complete(r2) (rerun: 64) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657477315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e300000000000000000090049e23a2e8d33910400000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x4, 0x80, 0x3, 0x896, 0x10, @dev={0xfe, 0x80, '\x00', 0x2e}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x80, 0x1, 0x8000, 0x4c3c73e3}}) sendmsg$nl_route(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@bridge_delvlan={0x38, 0x71, 0x100, 0x70bd25, 0x25dfdbfd, {0x7, 0x0, 0x0, r4}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_ID={0x8, 0x1, 0x3}}}, @BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8, 0x2, 0x13}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x40000) (async) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x9a, 0x40000) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f00000000c0)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x52b9c6) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = syz_io_uring_complete(0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000200)=0x54) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f00000000c0)=""/129, &(0x7f0000000180)=0x81) setsockopt$SO_J1939_SEND_PRIO(0xffffffffffffffff, 0x6b, 0x3, &(0x7f00000001c0)=0x5, 0x4) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000000, 0x10, r2, 0x8000000) (async, rerun: 64) r3 = syz_io_uring_complete(r1) (rerun: 64) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x24044014}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) write$P9_RLERRORu(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="160004960702000000274cd330699ee6e6d100ab4c00"], 0x16) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='ev/bsg\x00'/22], 0x87ffff2) 10:01:52 executing program 5: syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), 0xffffffffffffffff) ioctl$SCSI_IOCTL_STOP_UNIT(0xffffffffffffffff, 0x6) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffc, 0x414000) (async) r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x1000, 0x111040) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000100)) (async) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) (async, rerun: 32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$NLBL_MGMT_C_LISTDEF(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008044}, 0x4004041) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x52b9c6) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = syz_io_uring_complete(0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000200)=0x54) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) (async) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f00000000c0)=""/129, &(0x7f0000000180)=0x81) (async) setsockopt$SO_J1939_SEND_PRIO(0xffffffffffffffff, 0x6b, 0x3, &(0x7f00000001c0)=0x5, 0x4) (async) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x80, 0x200200) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f00000000c0)=0xef) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000140)={0x77359400}, 0x10) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x52b9c6) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = syz_io_uring_complete(0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000200)=0x54) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f00000000c0)=""/129, &(0x7f0000000180)=0x81) setsockopt$SO_J1939_SEND_PRIO(0xffffffffffffffff, 0x6b, 0x3, &(0x7f00000001c0)=0x5, 0x4) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) syz_io_uring_complete(0x0) (async) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000200)=0x54) (async) socket$pptp(0x18, 0x1, 0x2) (async) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) (async) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f00000000c0)=""/129, &(0x7f0000000180)=0x81) (async) setsockopt$SO_J1939_SEND_PRIO(0xffffffffffffffff, 0x6b, 0x3, &(0x7f00000001c0)=0x5, 0x4) (async) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)) (async) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x80, 0x200200) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f00000000c0)=0xef) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000140)={0x77359400}, 0x10) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x80, 0x200200) (async) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f00000000c0)=0xef) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) (async) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) (async) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000140)={0x77359400}, 0x10) (async) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 10:01:52 executing program 5: ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000080)=0x9a) r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x4a000) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x9, 0x10, r3, 0x0) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000180)=[{&(0x7f00000001c0)="c5658b70b26addc83175c3ffc2808c6595491ae9e9f38d802613b21cc0036f2f1e50e60660fabbe36aa91f54f1bd76a8bd8dc6670f2ab9ca3143b5cfb53a0849c8db947245ff079b23c587cd85caa6a1ab7d96296819cb05d251e9ae9d020354079634", 0x63}, {&(0x7f0000000140)="b0a793f1", 0x4}], 0x2, &(0x7f0000000640)=ANY=[@ANYBLOB="fc000000000000000000000007000000071bd37f000001ac1e0101ffffffffe0000001ac1414bb0000000000862f000000000709d4158a650fa4bf05080fbb50e2a00506079b6eb2f5a001117e496096d581206118508851428aff071b557f000001e00000027f0000017f0000010a010100ac1e0001890b5600000000ac1414aa442c2131ac14141d00000000ac1414bb0000b08b7f00000100000000ac1e000100000007e0000001000000604424de010a01010100000007e00400020000ae8b14a953fec0bd0001ffffffff00001000ffff21000102000000187a200000006400000a1a00000008000000ff0000001f8913f7ac1414bb00000000ac1414bbac1e01010000000014000000000000000000000001000000010000000000000014000000000000000000000002000000e0ffffff00000000140000000000000000000000010000000900000000000000d162f004a219bce45ffa042bd297522efc5d0d51e4f9ca053ebd15b9b856dd0b5cc4e1bb825cf9143867e63a1ae2ee6c42f22d1956fbceeedbfee7d2f35c12652b4d2b517d4b08d7c9f11e9e4c5c712a93d2f62354ba780489d12ae41f9fc5198c20bf51dd713a6d99f351ae72eee0fd93846405dbc1ec3169f465f3f5ae319e788137b8bab77f729ae62b0fbd0f73051015a6f02b19846833a3dc567ab2e91a4e5fabf31c99686a947e933c1e422c673ea7a19f626e5502d25345f62e0d8c5c1268be3d6570ed078c87485c80d46cda5a94bb432b843596463fabbce0c6cfbfad001c0b333b"], 0x148}, 0x24004050) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000000, 0x10, r2, 0x8000000) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x24044014}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) write$P9_RLERRORu(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="160004960702000000274cd330699ee6e6d100ab4c00"], 0x16) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='ev/bsg\x00'/22], 0x87ffff2) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000000, 0x10, r2, 0x8000000) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x24044014}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) write$P9_RLERRORu(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="160004960702000000274cd330699ee6e6d100ab4c00"], 0x16) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='ev/bsg\x00'/22], 0x87ffff2) (async) 10:01:52 executing program 4: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000180)=[{&(0x7f00000001c0)="c5658b70b26addc83175c3ffc2808c6595491ae9e9f38d802613b21cc0036f2f1e50e60660fabbe36aa91f54f1bd76a8bd8dc6670f2ab9ca3143b5cfb53a0849c8db947245ff079b23c587cd85caa6a1ab7d96296819cb05d251e9ae9d020354079634", 0x63}, {&(0x7f0000000140)="b0a793f1", 0x4}], 0x2, &(0x7f0000000640)=ANY=[@ANYBLOB="fc000000000000000000000007000000071bd37f000001ac1e0101ffffffffe0000001ac1414bb0000000000862f000000000709d4158a650fa4bf05080fbb50e2a00506079b6eb2f5a001117e496096d581206118508851428aff071b557f000001e00000027f0000017f0000010a010100ac1e0001890b5600000000ac1414aa442c2131ac14141d00000000ac1414bb0000b08b7f00000100000000ac1e000100000007e0000001000000604424de010a01010100000007e00400020000ae8b14a953fec0bd0001ffffffff00001000ffff21000102000000187a200000006400000a1a00000008000000ff0000001f8913f7ac1414bb00000000ac1414bbac1e01010000000014000000000000000000000001000000010000000000000014000000000000000000000002000000e0ffffff00000000140000000000000000000000010000000900000000000000d162f004a219bce45ffa042bd297522efc5d0d51e4f9ca053ebd15b9b856dd0b5cc4e1bb825cf9143867e63a1ae2ee6c42f22d1956fbceeedbfee7d2f35c12652b4d2b517d4b08d7c9f11e9e4c5c712a93d2f62354ba780489d12ae41f9fc5198c20bf51dd713a6d99f351ae72eee0fd93846405dbc1ec3169f465f3f5ae319e788137b8bab77f729ae62b0fbd0f73051015a6f02b19846833a3dc567ab2e91a4e5fabf31c99686a947e933c1e422c673ea7a19f626e5502d25345f62e0d8c5c1268be3d6570ed078c87485c80d46cda5a94bb432b843596463fabbce0c6cfbfad001c0b333b"], 0x148}, 0x24004050) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000180)=[{&(0x7f00000001c0)="c5658b70b26addc83175c3ffc2808c6595491ae9e9f38d802613b21cc0036f2f1e50e60660fabbe36aa91f54f1bd76a8bd8dc6670f2ab9ca3143b5cfb53a0849c8db947245ff079b23c587cd85caa6a1ab7d96296819cb05d251e9ae9d020354079634", 0x63}, {&(0x7f0000000140)="b0a793f1", 0x4}], 0x2, &(0x7f0000000640)=ANY=[@ANYBLOB="fc000000000000000000000007000000071bd37f000001ac1e0101ffffffffe0000001ac1414bb0000000000862f000000000709d4158a650fa4bf05080fbb50e2a00506079b6eb2f5a001117e496096d581206118508851428aff071b557f000001e00000027f0000017f0000010a010100ac1e0001890b5600000000ac1414aa442c2131ac14141d00000000ac1414bb0000b08b7f00000100000000ac1e000100000007e0000001000000604424de010a01010100000007e00400020000ae8b14a953fec0bd0001ffffffff00001000ffff21000102000000187a200000006400000a1a00000008000000ff0000001f8913f7ac1414bb00000000ac1414bbac1e01010000000014000000000000000000000001000000010000000000000014000000000000000000000002000000e0ffffff00000000140000000000000000000000010000000900000000000000d162f004a219bce45ffa042bd297522efc5d0d51e4f9ca053ebd15b9b856dd0b5cc4e1bb825cf9143867e63a1ae2ee6c42f22d1956fbceeedbfee7d2f35c12652b4d2b517d4b08d7c9f11e9e4c5c712a93d2f62354ba780489d12ae41f9fc5198c20bf51dd713a6d99f351ae72eee0fd93846405dbc1ec3169f465f3f5ae319e788137b8bab77f729ae62b0fbd0f73051015a6f02b19846833a3dc567ab2e91a4e5fabf31c99686a947e933c1e422c673ea7a19f626e5502d25345f62e0d8c5c1268be3d6570ed078c87485c80d46cda5a94bb432b843596463fabbce0c6cfbfad001c0b333b"], 0x148}, 0x24004050) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) 10:01:52 executing program 1: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x6) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000000c0)={'rose0\x00', {0x2, 0x4e28, @remote}}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_io_uring_complete(0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000240), 0x4200, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000280)={0x4f, ""/79}) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000100)=0x1) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="45000001", @ANYRES16=0x0, @ANYBLOB="29002bbd7000fbdbdf250200000008000400ac1e0001080008000300000008000800030000000c0003000300000000000000"], 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x20000801) 10:01:52 executing program 5: ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000080)=0x9a) r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x4a000) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x9, 0x10, r3, 0x0) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000080)=0x9a) (async) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0x0) (async) syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x4a000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f00000000c0)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x9, 0x10, r3, 0x0) (async) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x80, 0x200200) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f00000000c0)=0xef) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) (async) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r2, 0x28, 0x6, &(0x7f0000000140)={0x77359400}, 0x10) 10:01:52 executing program 4: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000180)=[{&(0x7f00000001c0)="c5658b70b26addc83175c3ffc2808c6595491ae9e9f38d802613b21cc0036f2f1e50e60660fabbe36aa91f54f1bd76a8bd8dc6670f2ab9ca3143b5cfb53a0849c8db947245ff079b23c587cd85caa6a1ab7d96296819cb05d251e9ae9d020354079634", 0x63}, {&(0x7f0000000140)="b0a793f1", 0x4}], 0x2, &(0x7f0000000640)=ANY=[@ANYBLOB="fc000000000000000000000007000000071bd37f000001ac1e0101ffffffffe0000001ac1414bb0000000000862f000000000709d4158a650fa4bf05080fbb50e2a00506079b6eb2f5a001117e496096d581206118508851428aff071b557f000001e00000027f0000017f0000010a010100ac1e0001890b5600000000ac1414aa442c2131ac14141d00000000ac1414bb0000b08b7f00000100000000ac1e000100000007e0000001000000604424de010a01010100000007e00400020000ae8b14a953fec0bd0001ffffffff00001000ffff21000102000000187a200000006400000a1a00000008000000ff0000001f8913f7ac1414bb00000000ac1414bbac1e01010000000014000000000000000000000001000000010000000000000014000000000000000000000002000000e0ffffff00000000140000000000000000000000010000000900000000000000d162f004a219bce45ffa042bd297522efc5d0d51e4f9ca053ebd15b9b856dd0b5cc4e1bb825cf9143867e63a1ae2ee6c42f22d1956fbceeedbfee7d2f35c12652b4d2b517d4b08d7c9f11e9e4c5c712a93d2f62354ba780489d12ae41f9fc5198c20bf51dd713a6d99f351ae72eee0fd93846405dbc1ec3169f465f3f5ae319e788137b8bab77f729ae62b0fbd0f73051015a6f02b19846833a3dc567ab2e91a4e5fabf31c99686a947e933c1e422c673ea7a19f626e5502d25345f62e0d8c5c1268be3d6570ed078c87485c80d46cda5a94bb432b843596463fabbce0c6cfbfad001c0b333b"], 0x148}, 0x24004050) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000180)=[{&(0x7f00000001c0)="c5658b70b26addc83175c3ffc2808c6595491ae9e9f38d802613b21cc0036f2f1e50e60660fabbe36aa91f54f1bd76a8bd8dc6670f2ab9ca3143b5cfb53a0849c8db947245ff079b23c587cd85caa6a1ab7d96296819cb05d251e9ae9d020354079634", 0x63}, {&(0x7f0000000140)="b0a793f1", 0x4}], 0x2, &(0x7f0000000640)=ANY=[@ANYBLOB="fc000000000000000000000007000000071bd37f000001ac1e0101ffffffffe0000001ac1414bb0000000000862f000000000709d4158a650fa4bf05080fbb50e2a00506079b6eb2f5a001117e496096d581206118508851428aff071b557f000001e00000027f0000017f0000010a010100ac1e0001890b5600000000ac1414aa442c2131ac14141d00000000ac1414bb0000b08b7f00000100000000ac1e000100000007e0000001000000604424de010a01010100000007e00400020000ae8b14a953fec0bd0001ffffffff00001000ffff21000102000000187a200000006400000a1a00000008000000ff0000001f8913f7ac1414bb00000000ac1414bbac1e01010000000014000000000000000000000001000000010000000000000014000000000000000000000002000000e0ffffff00000000140000000000000000000000010000000900000000000000d162f004a219bce45ffa042bd297522efc5d0d51e4f9ca053ebd15b9b856dd0b5cc4e1bb825cf9143867e63a1ae2ee6c42f22d1956fbceeedbfee7d2f35c12652b4d2b517d4b08d7c9f11e9e4c5c712a93d2f62354ba780489d12ae41f9fc5198c20bf51dd713a6d99f351ae72eee0fd93846405dbc1ec3169f465f3f5ae319e788137b8bab77f729ae62b0fbd0f73051015a6f02b19846833a3dc567ab2e91a4e5fabf31c99686a947e933c1e422c673ea7a19f626e5502d25345f62e0d8c5c1268be3d6570ed078c87485c80d46cda5a94bb432b843596463fabbce0c6cfbfad001c0b333b"], 0x148}, 0x24004050) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) 10:01:52 executing program 5: ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f0000000080)=0x9a) r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0x0) (async, rerun: 64) syz_open_dev$sg(&(0x7f0000000000), 0x3, 0x4a000) (rerun: 64) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f00000000c0)) (rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x9, 0x10, r3, 0x0) 10:01:52 executing program 1: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x6) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000000c0)={'rose0\x00', {0x2, 0x4e28, @remote}}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_io_uring_complete(0x0) (async) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000240), 0x4200, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000280)={0x4f, ""/79}) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000100)=0x1) (async, rerun: 32) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="45000001", @ANYRES16=0x0, @ANYBLOB="29002bbd7000fbdbdf250200000008000400ac1e0001080008000300000008000800030000000c0003000300000000000000"], 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x20000801) (rerun: 32) 10:01:52 executing program 0: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2203, &(0x7f0000000000)) 10:01:52 executing program 4: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2270, &(0x7f0000000000)) (async) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)={0x21, 0x7, 0x0, {{0xfffffffffffffe4e, '/de\x85Q\xd0D\x12+\x02T?:mv\x00\x00\x00\x00\x00'}}}, 0x21) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4000c136, 0xa802) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x20853, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000400)=@IORING_OP_ASYNC_CANCEL={0xe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x5) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f00000000c0)) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f0000000080)) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000001240)={0x53, 0xffffffffffffffff, 0x44, 0x76, @buffer={0x0, 0x1000, &(0x7f0000000100)=""/4096}, &(0x7f0000001100)="40ef0fc08ad52ab8f01c9947f60e6f199372c42624f587b7bd8168450655fc47dff716a8b2e8bbb484ab564e6f047d2fba71e83f8407b15b93c121131d81ad91ff010d6b", &(0x7f0000001180)=""/70, 0x100, 0x10004, 0x1, &(0x7f0000001200)}) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2044c2, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x32, 0xfffffff8, 0x0, "7211871e9d1aac31c43d4b6dc393cadfa48f544051be14139e42b14e70ed0ab523dca6293ceb0c9a07378ad57eb0d63ddfb4"}) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000012c0)={r1}, 0x8) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000001300)) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) connect$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x103, 0x9, 0x3, 0x4, 0xb2}, 0x10) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x114, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a300000e304c4c8a008c9e1445e813a4f8900000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a30000000000800410072786500140033007665"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f00000000c0)) 10:01:52 executing program 1: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x6) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000000c0)={'rose0\x00', {0x2, 0x4e28, @remote}}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_io_uring_complete(0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000240), 0x4200, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000280)={0x4f, ""/79}) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000100)=0x1) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="45000001", @ANYRES16=0x0, @ANYBLOB="29002bbd7000fbdbdf250200000008000400ac1e0001080008000300000008000800030000000c0003000300000000000000"], 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x20000801) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x6) (async) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000000c0)={'rose0\x00', {0x2, 0x4e28, @remote}}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_io_uring_complete(0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000240), 0x4200, 0x0) (async) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000280)={0x4f, ""/79}) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000100)=0x1) (async) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="45000001", @ANYRES16=0x0, @ANYBLOB="29002bbd7000fbdbdf250200000008000400ac1e0001080008000300000008000800030000000c0003000300000000000000"], 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x20000801) (async) 10:01:52 executing program 0: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2203, &(0x7f0000000000)) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4000c136, 0xa802) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x20853, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000400)=@IORING_OP_ASYNC_CANCEL={0xe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x5) (async) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f00000000c0)) (async) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f0000000080)) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x101, 0x600) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) 10:01:52 executing program 0: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2203, &(0x7f0000000000)) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000001240)={0x53, 0xffffffffffffffff, 0x44, 0x76, @buffer={0x0, 0x1000, &(0x7f0000000100)=""/4096}, &(0x7f0000001100)="40ef0fc08ad52ab8f01c9947f60e6f199372c42624f587b7bd8168450655fc47dff716a8b2e8bbb484ab564e6f047d2fba71e83f8407b15b93c121131d81ad91ff010d6b", &(0x7f0000001180)=""/70, 0x100, 0x10004, 0x1, &(0x7f0000001200)}) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2044c2, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x32, 0xfffffff8, 0x0, "7211871e9d1aac31c43d4b6dc393cadfa48f544051be14139e42b14e70ed0ab523dca6293ceb0c9a07378ad57eb0d63ddfb4"}) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000012c0)={r1}, 0x8) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000001300)) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)={0x21, 0x7, 0x0, {{0xfffffffffffffe4e, '/de\x85Q\xd0D\x12+\x02T?:mv\x00\x00\x00\x00\x00'}}}, 0x21) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async, rerun: 64) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000001240)={0x53, 0xffffffffffffffff, 0x44, 0x76, @buffer={0x0, 0x1000, &(0x7f0000000100)=""/4096}, &(0x7f0000001100)="40ef0fc08ad52ab8f01c9947f60e6f199372c42624f587b7bd8168450655fc47dff716a8b2e8bbb484ab564e6f047d2fba71e83f8407b15b93c121131d81ad91ff010d6b", &(0x7f0000001180)=""/70, 0x100, 0x10004, 0x1, &(0x7f0000001200)}) (rerun: 64) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2044c2, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x32, 0xfffffff8, 0x0, "7211871e9d1aac31c43d4b6dc393cadfa48f544051be14139e42b14e70ed0ab523dca6293ceb0c9a07378ad57eb0d63ddfb4"}) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000012c0)={r1}, 0x8) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000001300)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) connect$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x103, 0x9, 0x3, 0x4, 0xb2}, 0x10) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async, rerun: 64) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x114, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a300000e304c4c8a008c9e1445e813a4f8900000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a30000000000800410072786500140033007665"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f00000000c0)) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x101, 0x600) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async, rerun: 64) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) (rerun: 64) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4000c136, 0xa802) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) (async, rerun: 32) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async, rerun: 64) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x20853, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000400)=@IORING_OP_ASYNC_CANCEL={0xe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x5) (async) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async, rerun: 64) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f00000000c0)) (async) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f0000000080)) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)={0x21, 0x7, 0x0, {{0xfffffffffffffe4e, '/de\x85Q\xd0D\x12+\x02T?:mv\x00\x00\x00\x00\x00'}}}, 0x21) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f0000000040)={0x21, 0x7, 0x0, {{0xfffffffffffffe4e, '/de\x85Q\xd0D\x12+\x02T?:mv\x00\x00\x00\x00\x00'}}}, 0x21) (async) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) connect$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x103, 0x9, 0x3, 0x4, 0xb2}, 0x10) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (rerun: 32) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x114, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a300000e304c4c8a008c9e1445e813a4f8900000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a30000000000800410072786500140033007665"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f00000000c0)) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x101, 0x600) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x101, 0x600) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) (async) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x94, 0x8000, 0x9, "09bb67bdc678ba21e97339600bfaa7c828901c32fd144c266295fd13375c7b45abad554df94ac328327be9a93d871d98a2b0f0a0a749b14917ed9b2ab7ae6523be86d32e8451f5ee48f607a71cbcc3d1fc726143ed12c20d3b3ede2d77c5cf8e49843a840a6f6841c6a82987a886d30850e890d1de5c757ecc0adc7afc6290d8dbaf6412f08b0e41ccb3c557569da953396565fa"}) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000080)={0x75, ""/117}) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000040)={'syztnl0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x1f, 0x3, 0x0, @private2, @private2, 0x700, 0x80, 0x28d, 0x7ab099e8}}) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'ip6erspan0\x00', &(0x7f0000000040)=ANY=[]}) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000080)) (async, rerun: 64) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (rerun: 64) 10:01:52 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x100, 0x300) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) syz_io_uring_complete(r1) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000080)=0x2, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000000)=0x16) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x94, 0x8000, 0x9, "09bb67bdc678ba21e97339600bfaa7c828901c32fd144c266295fd13375c7b45abad554df94ac328327be9a93d871d98a2b0f0a0a749b14917ed9b2ab7ae6523be86d32e8451f5ee48f607a71cbcc3d1fc726143ed12c20d3b3ede2d77c5cf8e49843a840a6f6841c6a82987a886d30850e890d1de5c757ecc0adc7afc6290d8dbaf6412f08b0e41ccb3c557569da953396565fa"}) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000080)={0x75, ""/117}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) (async) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000080)={0x75, ""/117}) (async) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x94, 0x8000, 0x9, "09bb67bdc678ba21e97339600bfaa7c828901c32fd144c266295fd13375c7b45abad554df94ac328327be9a93d871d98a2b0f0a0a749b14917ed9b2ab7ae6523be86d32e8451f5ee48f607a71cbcc3d1fc726143ed12c20d3b3ede2d77c5cf8e49843a840a6f6841c6a82987a886d30850e890d1de5c757ecc0adc7afc6290d8dbaf6412f08b0e41ccb3c557569da953396565fa"}) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x94, 0x8000, 0x9, "09bb67bdc678ba21e97339600bfaa7c828901c32fd144c266295fd13375c7b45abad554df94ac328327be9a93d871d98a2b0f0a0a749b14917ed9b2ab7ae6523be86d32e8451f5ee48f607a71cbcc3d1fc726143ed12c20d3b3ede2d77c5cf8e49843a840a6f6841c6a82987a886d30850e890d1de5c757ecc0adc7afc6290d8dbaf6412f08b0e41ccb3c557569da953396565fa"}) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000040)={'syztnl0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x1f, 0x3, 0x0, @private2, @private2, 0x700, 0x80, 0x28d, 0x7ab099e8}}) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'ip6erspan0\x00', &(0x7f0000000040)=ANY=[]}) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) socket$pptp(0x18, 0x1, 0x2) (async) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000040)={'syztnl0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x1f, 0x3, 0x0, @private2, @private2, 0x700, 0x80, 0x28d, 0x7ab099e8}}) (async) socket$pptp(0x18, 0x1, 0x2) (async) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) (async) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'ip6erspan0\x00', &(0x7f0000000040)=ANY=[]}) (async) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000100)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000000c0)=0x1) 10:01:52 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x100, 0x300) (async) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000080)=0x2, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000000)=0x16) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) (async) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000080)={0x75, ""/117}) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000040)={'syztnl0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x1f, 0x3, 0x0, @private2, @private2, 0x700, 0x80, 0x28d, 0x7ab099e8}}) r2 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'ip6erspan0\x00', &(0x7f0000000040)=ANY=[]}) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_io_uring_complete(0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000080)=0x47f) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(0xffffffffffffffff, 0x3) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0x150, 0x1403, 0x0, 0x70bd2a, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'geneve0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_bridge\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team_slave_1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_to_team\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'nr0\x00'}}]}, 0x150}, 0x1, 0x0, 0x0, 0x40000}, 0x2002c800) 10:01:52 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x100, 0x300) (async) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) syz_io_uring_complete(r1) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000080)=0x2, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000000)=0x16) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000100)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async, rerun: 32) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) (rerun: 32) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000000c0)=0x1) 10:01:52 executing program 1: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x20, 0x3, 0x7}, 0x1}}, 0x18) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) write$P9_RLERROR(r1, &(0x7f0000000080)={0xd, 0x7, 0x2, {0x4, '#[+\x03'}}, 0xd) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x105002) ioctl$SG_GET_NUM_WAITING(r2, 0x2201, &(0x7f0000000000)) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_io_uring_complete(0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000080)=0x47f) (async, rerun: 64) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(0xffffffffffffffff, 0x3) (rerun: 64) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0x150, 0x1403, 0x0, 0x70bd2a, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'geneve0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_bridge\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team_slave_1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_to_team\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'nr0\x00'}}]}, 0x150}, 0x1, 0x0, 0x0, 0x40000}, 0x2002c800) 10:01:52 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x40600, 0x0) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x20008464}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x94, 0x8000, 0x9, "09bb67bdc678ba21e97339600bfaa7c828901c32fd144c266295fd13375c7b45abad554df94ac328327be9a93d871d98a2b0f0a0a749b14917ed9b2ab7ae6523be86d32e8451f5ee48f607a71cbcc3d1fc726143ed12c20d3b3ede2d77c5cf8e49843a840a6f6841c6a82987a886d30850e890d1de5c757ecc0adc7afc6290d8dbaf6412f08b0e41ccb3c557569da953396565fa"}) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000100)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000000c0)=0x1) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x1, {{0x9, '/dev/bsg\x00'}, 0x20}}, 0x16) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x2f, 0x3, 0x40, 0x4, 0x5, @private0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x7, 0x8000, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r4, 0x2f, 0x80, 0x20, 0x7, 0x6e, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x7800, 0x10, 0x3ff, 0x42c7}}) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) 10:01:52 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x40600, 0x0) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x20008464}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x40600, 0x0) (async) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x20008464}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x94, 0x8000, 0x9, "09bb67bdc678ba21e97339600bfaa7c828901c32fd144c266295fd13375c7b45abad554df94ac328327be9a93d871d98a2b0f0a0a749b14917ed9b2ab7ae6523be86d32e8451f5ee48f607a71cbcc3d1fc726143ed12c20d3b3ede2d77c5cf8e49843a840a6f6841c6a82987a886d30850e890d1de5c757ecc0adc7afc6290d8dbaf6412f08b0e41ccb3c557569da953396565fa"}) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:52 executing program 1: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x20, 0x3, 0x7}, 0x1}}, 0x18) (async, rerun: 64) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (rerun: 64) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) write$P9_RLERROR(r1, &(0x7f0000000080)={0xd, 0x7, 0x2, {0x4, '#[+\x03'}}, 0xd) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x105002) ioctl$SG_GET_NUM_WAITING(r2, 0x2201, &(0x7f0000000000)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x1, {{0x9, '/dev/bsg\x00'}, 0x20}}, 0x16) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x2f, 0x3, 0x40, 0x4, 0x5, @private0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x7, 0x8000, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r4, 0x2f, 0x80, 0x20, 0x7, 0x6e, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x7800, 0x10, 0x3ff, 0x42c7}}) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_io_uring_complete(0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000080)=0x47f) (async) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(0xffffffffffffffff, 0x3) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async, rerun: 32) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0x150, 0x1403, 0x0, 0x70bd2a, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'geneve0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'syzkaller1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_bridge\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team_slave_1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_to_team\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'nr0\x00'}}]}, 0x150}, 0x1, 0x0, 0x0, 0x40000}, 0x2002c800) 10:01:52 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x40600, 0x0) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x20008464}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x40600, 0x0) (async) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x20008464}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async) 10:01:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x94, 0x8000, 0x9, "09bb67bdc678ba21e97339600bfaa7c828901c32fd144c266295fd13375c7b45abad554df94ac328327be9a93d871d98a2b0f0a0a749b14917ed9b2ab7ae6523be86d32e8451f5ee48f607a71cbcc3d1fc726143ed12c20d3b3ede2d77c5cf8e49843a840a6f6841c6a82987a886d30850e890d1de5c757ecc0adc7afc6290d8dbaf6412f08b0e41ccb3c557569da953396565fa"}) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) 10:01:52 executing program 5: r0 = epoll_create1(0x0) epoll_pwait2(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, &(0x7f00000000c0), &(0x7f0000000100)={[0xa274]}, 0x8) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) epoll_pwait2(r3, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x7, &(0x7f00000001c0), &(0x7f0000000200)={[0x4]}, 0x8) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:52 executing program 1: write$P9_RLOPEN(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x20, 0x3, 0x7}, 0x1}}, 0x18) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) write$P9_RLERROR(r1, &(0x7f0000000080)={0xd, 0x7, 0x2, {0x4, '#[+\x03'}}, 0xd) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x105002) ioctl$SG_GET_NUM_WAITING(r2, 0x2201, &(0x7f0000000000)) write$P9_RLOPEN(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x20, 0x3, 0x7}, 0x1}}, 0x18) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) write$P9_RLERROR(r1, &(0x7f0000000080)={0xd, 0x7, 0x2, {0x4, '#[+\x03'}}, 0xd) (async) syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x105002) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2201, &(0x7f0000000000)) (async) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@deltaction={0x28, 0x31, 0x400, 0x70bd27, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x8000) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000180)) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x4aa042) r1 = syz_io_uring_complete(0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000001240)={0x53, 0xfffffffffffffffb, 0x1000, 0x6, @buffer={0x0, 0xb0, &(0x7f00000000c0)=""/176}, &(0x7f0000000180)="df79f8b1dfce69d741860746843cc104039f6651ac9f1184fe8d194a914a3d9bd9fb4f077067f9e2be971087f97f9f374eff2b8e573c62dbe570f33cceeb60dd4702d67c0ef523a979a4630def6faf1e92d44a8fcf47e335ee82a8bcedf10e886bc2b3b14562d1233a921dce4fe52d3092ebbac5d329db6d2df72eab25d013a08d3cf9a4b4526565c64e148cd555d461073540e9394e5505cdb23688330ac4c4a8e5d00d5e6eb026a1633e2268d112367cd5c16da037ac1ed937dc3d251e348ca1ec815a26c9a6b31250c9f53c6380693c590b6328bf273d324f2e9014af07c34d03cf877f8780f760a062e1e0edfacf6565f7d73ab49f24fbb6d5b800b34fc2c55aac2bf96bf87f011442eb5c2c365a107f8eb7e7caf038e873395b963c45f5380826404a3abfec60892a12633c98386d705f16470271cfac2e111835131ccf790962c4a52f7c67fb731d1604ea26fb2dd7aa8ce1fb1fb372695172f66d3275b29174362df7f4535595303e8b55fb1351234461373f61d530f1eab0458e5dec7434c78017ef0a80dbdb601d558313410f8263a1244d847624ee45c709a089d0161c5cbf487cdda48c56babf95bea19428cb5dc854fb260cd93bf678fcbc02292edc51abb1db38b78ff10d47e843e092ef6f556f3dcc2e5ef853aedd760717fc0a7545b56bd5e3ad591f0580e03271a199213f9104eef79228900e7075f8e124aafbfe355707c85518ca2df769a0783f3e3fda28694efb3a54e8a8523900736fa9b9b3832c74f52abab8994def9c52dfc2f8099d6b61e6fe5762396c8cd7e543ec6f4c133be9d31b718654603c017d07812674343df681251fc5fdcdb4c7a505742689895b4ad360397ab0d6afb872351419e220d63e7cf2e16edfc189c8f0d40ea02bb4c830221f6c4079e430e5c6acec9fc21fbd79cbeff0cf172f08b5605a44e5ff719648f6fd1a87fb3537b8bf1ca561ab2c072cb1cc263513a8b1a3460c56db7ca32b251f619ef709465e29ec9515e9a225d58d4965aebd9c3217fbe36ecee9140ac1a231f5ac0de084324b681f314b5e7e03c0dab16090a8388ba4f71a87692f9d00b41499f666b27742872e5df96b699e6d0326a18df50753159d2c1a2bbf9a00f10f010e8b1ddee5b5b96aafc8b41ddb4354b1277ae949aefdf660a0e3917f8924ec58479eb943195a87a64ba9e34787c8db0ecfd2473f55138cc442622d516ea03575823a62b059faeb21b68503de70544b82bcd372d54612f4adaa3d3b5a2c5b952bdc7c0b8142fe22015d456db672b73affcf4d7d58aff74cb53fb54f64684e3ae0c7630de51c192eb18e31ee72e06db5fb69676cfaf2a3692d72ad1997d924fc80076257739efdacb697309b3db3e28cfb4f5388a84fd4bb1661c9dd6ab915e00d24410fdbf2b52a3cf2f1328a3857461856e4f2d5e924bb1b7f3c8e0ba7fae16567071b4f3df62c381fe5e432839926c0eed4eddfaf3345b15d3a4b171a7aa5bbb5929a3cef96f6301c89812ed7cd206efa623afa55eccdb675240d6989b127020b467f6929e16f97fac1222283771c7f80d7ad29b8123bab5146a8199e8f90312799003ea8f58ccb03823c56babd9c70ca6be3b5e95a6d5aca7038870be449753d756dc0c4e365d470a247d8c68d4194823eb5780e19e365edcc9281f25c8b567155a2dd94b0745436662a83a15ecf5f008c60db9ae4bf3426b4bb78cd2b411535e31742a9aa159e428c903a6d17a0ee61764119fd67ed81c4385b4f05e404ac678fcc6cd8349b6702018cfc2833e0cffdf3593ee4a7168581d7f1a320804e4433dddf280ca2e4d7c1e0e7ba13d4acae8c9c1bc300e03c398ffb62875ea9b9875fe5de333dd820dbc647dd70eda8c40a69732fcc54ea7965ff069d8cf079ff161a0842be2ca055ece8c1838c6d498cd9629cefb7f5ced8891e64f0c023388cb576e78a246c3f4199a5bcaf4686a1b531be1ca053544621a7f6c21c3c47cabfaafbe749c86aa3c51d237f8d14ca5f9671ef26be1cbdbb4305b80222d0fdb2e689333b81cfd295c02e0fd1131949ce6b5a28b895f7f12175b7b664b79824d6d45299633dbad5850675b929932bcc18adfde9a7b95e549d58c0dc7de6bd9503437d6b6df783171f684ac632efce0740e4d4fae5e87b6425e9da1d5165f44a6214a7330bd975581358a4b77049d211d67cb7ab9fd7d2cc75cf5685db77c1df0f54b310e310bac1ad97d4692a38166aeba508dae78e2e07f9ef81a5a4b29785cdb5e94c794e21827e276b573190d6e3369255fa0ddd2ce3e8bcd42876cc2a874faff3e07eec2cad2207f86e0396745949f97a8a63c63958b2f09fd4f1d3cac12b5c6bc358598fe94b773e3178f1f30a6738ba0c35e29fb537593a4131e916c6f261a2b86f90e8fd2c523ec7da25a64819316760e1653ae10e411174b7ebb2a8d9ff92f428f63eec7eec783af2ba7256c0469fbd7c18271443e0d1e5f2b09e0f168eeb7257677d41ba72c9632356ac4bd798c6bc21e5059dfa85561758b4e22b929655299cc37d2cd97a204047d506531ac2143493e7735a17477e5972e817fd52ecb19ac3e1817de11311e31515e5d880feb62952fc0d21af2e5c0dc57a3efa6f970c98a7546662a261f28231a0daca669db3dda5b833c89804a84349d5b157327ac533da36e9cfc7c07db41031dfff33fe3c8ffc41ec0dea5b96f4d08bf51e12d1586069960312798db7e6b161c0728536c6def225ae7a63b17644cf04e16d097e53c34ff40f3f0a2441fcc4bd566052cbc43ea72685b7d5b571a2b89b48ded4cfa74eeb06d27922a7e6ce24fe71535e0abdaf947b4b850e25e33b562f013c156b4287074583cbda60035073077bfea6877e123173253885bf2acb85f4535f3160cb013ef0b89b5e2894282b72feb097edbe0dbf93b59ea2913084f8e0fadd286c5b78724ebdf9608d01a8ec9db530ab50d6595321361fd5a2f08ec9d3abe81cfd692421d6132d8af9f48efd94827fdf4391f28122b98c4c7d7e44e826eb3dde0ed0beb61a1046203cbb198d1be688d3e926640bac025f9e1e45582cd110ef53e70f1fa0b6039aa4bec5c12de7f5e0c31bab40ee979efd01fb325c9949e78e286e82402d13a82da1ce08a8d5a5e818ff5f7860a07cd7f8fbdf4db8c8ef45a61046ac422ad4d3a7bece2475382df491d84f590b15245e846ac27cd8a2efbf9db0c9ce1609246596fc4c565b2c4a3a6974cf787869a6fabb2415a234398acd6e60483feea21a71518bc38705f02c3d6d9199c1ad6778d2c6dc709d4b13dd1bd8b029e1e704fd80338a1bcb233e6a36bb23c729d8919a6301d93173f4588badccbe96c32ec0d162f0919f0614e4761e8381e2b98a0926730db3e1114d43dfc01516346d2eb6fe4f92066cbec51aee790500f34363a62974288e9f952e02a41838748484e9468d29e373af015b6e11aa90ed0a10611caed8b2c800cc8b3b6be16478d0b4539455f9415ef47e64fc74134d2bdb4c27f861db40314a12517d86fc1a93c59352968a4b9fb878945ee9a8ee78a44cd6a88417e1be0354c2f5002e4b076330afc3a21837d81222a82e39636145d477a8c03bb79ec847739125600eb744e7c793c76c79e504e0661166f290ea203a2486e71428d14607fd653fa0390b113d38e8adb339f2f56ec33ec149853179e36dd976634f838e596e56215340a64c26664e301d14653d61dd81e6fbd48953533da8f4a1e60ae8b0bc6a8b0838d550e44de4f87bc2c1d23647093dc041905702d4422cc16b9cf12337f1b7a514cca2715c6bb5b26323d4b6904782ccb8d4c4894bddd80b7cacff86633ecb2e1afac78e572e313730db63acbd8fc91fbeebc1a809c336754de246bfdc38668ae7b1f25cfb99024209a7fc7ded639f6d630ecf04b92a9ffe98eae9befed1c030f998425fb36c765f87b1867dc816efdcf60e0f230f709e5a401539d3457e427720f18ab457b7d6d3e4e43f97501b66cb4827b7a3602833444471e1e42e1eda563736fa66e667b1bbe8d08f142b729e6c95cbe3619744fdd112be5cb7eb9be1b10922e243b184e29bc8e67fdbb0c9836b8daa1b1c9edeb8d718d089520312bb70c943ea9c932b4b0f133795ab37c15bb745a667e9a6fa4b704d899e42d3931c1adb194081e4bc472a429f270cee5b2f21dccfef699b34fd4f1564fc062984a00e7a84935a4c799eaa6d6d3e9e8c7723414c9e7ba947e23858ab3e8e44bd0bd3a9e0d301f515387934c5e0e8b37ea2525504ecb1e59f5f402cb732369c131c6543869c835488a3702c287c5d99bf5940d2db8a854d70148824373979874953525bbe5b86dfd86205f45482742d51a97bb68b6e1c65007fb037af24158aa9a298edc763ba7c37b2bebe8fe42a59788c078345b0da473c8febc99da6d3e4d72073ccb89c2e13115ae61609ead07f6019d544134ef759eb71c09939912ef26dd6299123d292e3af664b32bd1db0f0636a054b5be97d0e237a4073e15a3f9311776194c357e4a0d253ad856243f7618195dda14c55fcae5a5b1f97add0f8956310ae70c828f656b8cc5211b452c6da870f7f7598cdd8d003411b84b4561efa0918805b179c82c88d405dfb1a7e74d64dfacb143a37d6d63842f9e4d1b6031fa435486621a65e0e515411a44f8be8c6e395e81d174a25ce3261aeedd92703c1d78a885acda218dd7ca14cb8ff9ae63717127310467f0390a20ed753d69a415065b73462687dcb18ff02c1badfaca103ed4810fbfb976774a7d6b157a879a2282b39bd011b880f8eb3b2ee737a23239cfbc6fd69dbc7c03d84afb4272c42bd15fea290f6359d024e11c145a47e79287e0dd3a172b8da75f20be3aa8fa39e01de0e3ec13d81564f6476d4362844716f6a05afe3f65fa6b87be4cf25bf43bffae2fd6247e6c42e98ad323cf6e87d2daca95fe67c3c1be344953471a36ae23ea5caed438048b882696bfc4f502ebc4a0155bb64d0c6027e8628c3d9b0ab84b8c048696a15a72e7ab8ba927f6d3c83f9c3f27bd35624361110f9424fa426084c92114a84a462a1aaa57148d00b1c5b17c58f39faccd5f8494c60bfb5faf8f78edfa342eabb53e3477519c81c439d33bf4dbff3b80d384f1a636a773f2e78ec1548b51f528c96977fecf0181703d9d3061261826b0b998ba1d580a23bd626adf4aa6cef4d21bbc461a7999f8aa409a9a06f0fbf79581b65520202cdc1f9f5c89403d221a5c169d57357ada5c9a13a73cef8796b16c106ed5c9d8bf3629ed3cf1855468b787c9b938ebac9d5cae52ea9143f5afcd2a75a34bb87831ff3d6307aab1f197f8978a00fadc6f3fb7fa36088922e0934f28edb3235918ce63dc33188fbdd12cd1df9931de61e587c705e12ef7b1a42de460c61fc2b291316b2161a0c7c8e26032a441e4c2c67c8c595615979cf261a21caf93c307a7ba9b26355bf737911cea8b956e4727b11daa01db014766b642d9e0efff68ab91ead5bc200145337dff2f43b1f2edead28b5bf89e37d04d5db2b4a0870a3e0bd4e1e51c605dc00d6c8eaec0ac6d93ba47e5121eff4d6c1932bc27f635d673bc8f24aa777de7ba4ebf1d5c7f3dcc099306a01048f7cd8a16a97f11b31a1bc013de7fe8356214ab415f623b32917dc8efdea513ee2d518f7f3b4500c89e2576254cb3e798af21270672a3dfd8dc8ddf7370a9945659754aaa22a2ded21fb317a85a0d1d6a60f47fe89713d47f52f0f32819907611d6607a2f766e3c2b0135939d6620328a12fa2d2e95e18a5252d", &(0x7f0000001180)=""/149, 0x6, 0x10004, 0x0, 0xfffffffffffffffe}) ioctl$SG_GET_NUM_WAITING(r1, 0x2203, &(0x7f0000000080)) 10:01:52 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)={0x94, 0x8000, 0x9, "09bb67bdc678ba21e97339600bfaa7c828901c32fd144c266295fd13375c7b45abad554df94ac328327be9a93d871d98a2b0f0a0a749b14917ed9b2ab7ae6523be86d32e8451f5ee48f607a71cbcc3d1fc726143ed12c20d3b3ede2d77c5cf8e49843a840a6f6841c6a82987a886d30850e890d1de5c757ecc0adc7afc6290d8dbaf6412f08b0e41ccb3c557569da953396565fa"}) 10:01:52 executing program 5: r0 = epoll_create1(0x0) epoll_pwait2(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, &(0x7f00000000c0), &(0x7f0000000100)={[0xa274]}, 0x8) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) epoll_pwait2(r3, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x7, &(0x7f00000001c0), &(0x7f0000000200)={[0x4]}, 0x8) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x1, {{0x9, '/dev/bsg\x00'}, 0x20}}, 0x16) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x2f, 0x3, 0x40, 0x4, 0x5, @private0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x7, 0x8000, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r4, 0x2f, 0x80, 0x20, 0x7, 0x6e, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x7800, 0x10, 0x3ff, 0x42c7}}) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x1, {{0x9, '/dev/bsg\x00'}, 0x20}}, 0x16) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r3, 0x89fa, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x2f, 0x3, 0x40, 0x4, 0x5, @private0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x7, 0x8000, 0x4}}) (async) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', r4, 0x2f, 0x80, 0x20, 0x7, 0x6e, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x7800, 0x10, 0x3ff, 0x42c7}}) (async) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x4aa042) (async) r1 = syz_io_uring_complete(0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000001240)={0x53, 0xfffffffffffffffb, 0x1000, 0x6, @buffer={0x0, 0xb0, &(0x7f00000000c0)=""/176}, &(0x7f0000000180)="df79f8b1dfce69d741860746843cc104039f6651ac9f1184fe8d194a914a3d9bd9fb4f077067f9e2be971087f97f9f374eff2b8e573c62dbe570f33cceeb60dd4702d67c0ef523a979a4630def6faf1e92d44a8fcf47e335ee82a8bcedf10e886bc2b3b14562d1233a921dce4fe52d3092ebbac5d329db6d2df72eab25d013a08d3cf9a4b4526565c64e148cd555d461073540e9394e5505cdb23688330ac4c4a8e5d00d5e6eb026a1633e2268d112367cd5c16da037ac1ed937dc3d251e348ca1ec815a26c9a6b31250c9f53c6380693c590b6328bf273d324f2e9014af07c34d03cf877f8780f760a062e1e0edfacf6565f7d73ab49f24fbb6d5b800b34fc2c55aac2bf96bf87f011442eb5c2c365a107f8eb7e7caf038e873395b963c45f5380826404a3abfec60892a12633c98386d705f16470271cfac2e111835131ccf790962c4a52f7c67fb731d1604ea26fb2dd7aa8ce1fb1fb372695172f66d3275b29174362df7f4535595303e8b55fb1351234461373f61d530f1eab0458e5dec7434c78017ef0a80dbdb601d558313410f8263a1244d847624ee45c709a089d0161c5cbf487cdda48c56babf95bea19428cb5dc854fb260cd93bf678fcbc02292edc51abb1db38b78ff10d47e843e092ef6f556f3dcc2e5ef853aedd760717fc0a7545b56bd5e3ad591f0580e03271a199213f9104eef79228900e7075f8e124aafbfe355707c85518ca2df769a0783f3e3fda28694efb3a54e8a8523900736fa9b9b3832c74f52abab8994def9c52dfc2f8099d6b61e6fe5762396c8cd7e543ec6f4c133be9d31b718654603c017d07812674343df681251fc5fdcdb4c7a505742689895b4ad360397ab0d6afb872351419e220d63e7cf2e16edfc189c8f0d40ea02bb4c830221f6c4079e430e5c6acec9fc21fbd79cbeff0cf172f08b5605a44e5ff719648f6fd1a87fb3537b8bf1ca561ab2c072cb1cc263513a8b1a3460c56db7ca32b251f619ef709465e29ec9515e9a225d58d4965aebd9c3217fbe36ecee9140ac1a231f5ac0de084324b681f314b5e7e03c0dab16090a8388ba4f71a87692f9d00b41499f666b27742872e5df96b699e6d0326a18df50753159d2c1a2bbf9a00f10f010e8b1ddee5b5b96aafc8b41ddb4354b1277ae949aefdf660a0e3917f8924ec58479eb943195a87a64ba9e34787c8db0ecfd2473f55138cc442622d516ea03575823a62b059faeb21b68503de70544b82bcd372d54612f4adaa3d3b5a2c5b952bdc7c0b8142fe22015d456db672b73affcf4d7d58aff74cb53fb54f64684e3ae0c7630de51c192eb18e31ee72e06db5fb69676cfaf2a3692d72ad1997d924fc80076257739efdacb697309b3db3e28cfb4f5388a84fd4bb1661c9dd6ab915e00d24410fdbf2b52a3cf2f1328a3857461856e4f2d5e924bb1b7f3c8e0ba7fae16567071b4f3df62c381fe5e432839926c0eed4eddfaf3345b15d3a4b171a7aa5bbb5929a3cef96f6301c89812ed7cd206efa623afa55eccdb675240d6989b127020b467f6929e16f97fac1222283771c7f80d7ad29b8123bab5146a8199e8f90312799003ea8f58ccb03823c56babd9c70ca6be3b5e95a6d5aca7038870be449753d756dc0c4e365d470a247d8c68d4194823eb5780e19e365edcc9281f25c8b567155a2dd94b0745436662a83a15ecf5f008c60db9ae4bf3426b4bb78cd2b411535e31742a9aa159e428c903a6d17a0ee61764119fd67ed81c4385b4f05e404ac678fcc6cd8349b6702018cfc2833e0cffdf3593ee4a7168581d7f1a320804e4433dddf280ca2e4d7c1e0e7ba13d4acae8c9c1bc300e03c398ffb62875ea9b9875fe5de333dd820dbc647dd70eda8c40a69732fcc54ea7965ff069d8cf079ff161a0842be2ca055ece8c1838c6d498cd9629cefb7f5ced8891e64f0c023388cb576e78a246c3f4199a5bcaf4686a1b531be1ca053544621a7f6c21c3c47cabfaafbe749c86aa3c51d237f8d14ca5f9671ef26be1cbdbb4305b80222d0fdb2e689333b81cfd295c02e0fd1131949ce6b5a28b895f7f12175b7b664b79824d6d45299633dbad5850675b929932bcc18adfde9a7b95e549d58c0dc7de6bd9503437d6b6df783171f684ac632efce0740e4d4fae5e87b6425e9da1d5165f44a6214a7330bd975581358a4b77049d211d67cb7ab9fd7d2cc75cf5685db77c1df0f54b310e310bac1ad97d4692a38166aeba508dae78e2e07f9ef81a5a4b29785cdb5e94c794e21827e276b573190d6e3369255fa0ddd2ce3e8bcd42876cc2a874faff3e07eec2cad2207f86e0396745949f97a8a63c63958b2f09fd4f1d3cac12b5c6bc358598fe94b773e3178f1f30a6738ba0c35e29fb537593a4131e916c6f261a2b86f90e8fd2c523ec7da25a64819316760e1653ae10e411174b7ebb2a8d9ff92f428f63eec7eec783af2ba7256c0469fbd7c18271443e0d1e5f2b09e0f168eeb7257677d41ba72c9632356ac4bd798c6bc21e5059dfa85561758b4e22b929655299cc37d2cd97a204047d506531ac2143493e7735a17477e5972e817fd52ecb19ac3e1817de11311e31515e5d880feb62952fc0d21af2e5c0dc57a3efa6f970c98a7546662a261f28231a0daca669db3dda5b833c89804a84349d5b157327ac533da36e9cfc7c07db41031dfff33fe3c8ffc41ec0dea5b96f4d08bf51e12d1586069960312798db7e6b161c0728536c6def225ae7a63b17644cf04e16d097e53c34ff40f3f0a2441fcc4bd566052cbc43ea72685b7d5b571a2b89b48ded4cfa74eeb06d27922a7e6ce24fe71535e0abdaf947b4b850e25e33b562f013c156b4287074583cbda60035073077bfea6877e123173253885bf2acb85f4535f3160cb013ef0b89b5e2894282b72feb097edbe0dbf93b59ea2913084f8e0fadd286c5b78724ebdf9608d01a8ec9db530ab50d6595321361fd5a2f08ec9d3abe81cfd692421d6132d8af9f48efd94827fdf4391f28122b98c4c7d7e44e826eb3dde0ed0beb61a1046203cbb198d1be688d3e926640bac025f9e1e45582cd110ef53e70f1fa0b6039aa4bec5c12de7f5e0c31bab40ee979efd01fb325c9949e78e286e82402d13a82da1ce08a8d5a5e818ff5f7860a07cd7f8fbdf4db8c8ef45a61046ac422ad4d3a7bece2475382df491d84f590b15245e846ac27cd8a2efbf9db0c9ce1609246596fc4c565b2c4a3a6974cf787869a6fabb2415a234398acd6e60483feea21a71518bc38705f02c3d6d9199c1ad6778d2c6dc709d4b13dd1bd8b029e1e704fd80338a1bcb233e6a36bb23c729d8919a6301d93173f4588badccbe96c32ec0d162f0919f0614e4761e8381e2b98a0926730db3e1114d43dfc01516346d2eb6fe4f92066cbec51aee790500f34363a62974288e9f952e02a41838748484e9468d29e373af015b6e11aa90ed0a10611caed8b2c800cc8b3b6be16478d0b4539455f9415ef47e64fc74134d2bdb4c27f861db40314a12517d86fc1a93c59352968a4b9fb878945ee9a8ee78a44cd6a88417e1be0354c2f5002e4b076330afc3a21837d81222a82e39636145d477a8c03bb79ec847739125600eb744e7c793c76c79e504e0661166f290ea203a2486e71428d14607fd653fa0390b113d38e8adb339f2f56ec33ec149853179e36dd976634f838e596e56215340a64c26664e301d14653d61dd81e6fbd48953533da8f4a1e60ae8b0bc6a8b0838d550e44de4f87bc2c1d23647093dc041905702d4422cc16b9cf12337f1b7a514cca2715c6bb5b26323d4b6904782ccb8d4c4894bddd80b7cacff86633ecb2e1afac78e572e313730db63acbd8fc91fbeebc1a809c336754de246bfdc38668ae7b1f25cfb99024209a7fc7ded639f6d630ecf04b92a9ffe98eae9befed1c030f998425fb36c765f87b1867dc816efdcf60e0f230f709e5a401539d3457e427720f18ab457b7d6d3e4e43f97501b66cb4827b7a3602833444471e1e42e1eda563736fa66e667b1bbe8d08f142b729e6c95cbe3619744fdd112be5cb7eb9be1b10922e243b184e29bc8e67fdbb0c9836b8daa1b1c9edeb8d718d089520312bb70c943ea9c932b4b0f133795ab37c15bb745a667e9a6fa4b704d899e42d3931c1adb194081e4bc472a429f270cee5b2f21dccfef699b34fd4f1564fc062984a00e7a84935a4c799eaa6d6d3e9e8c7723414c9e7ba947e23858ab3e8e44bd0bd3a9e0d301f515387934c5e0e8b37ea2525504ecb1e59f5f402cb732369c131c6543869c835488a3702c287c5d99bf5940d2db8a854d70148824373979874953525bbe5b86dfd86205f45482742d51a97bb68b6e1c65007fb037af24158aa9a298edc763ba7c37b2bebe8fe42a59788c078345b0da473c8febc99da6d3e4d72073ccb89c2e13115ae61609ead07f6019d544134ef759eb71c09939912ef26dd6299123d292e3af664b32bd1db0f0636a054b5be97d0e237a4073e15a3f9311776194c357e4a0d253ad856243f7618195dda14c55fcae5a5b1f97add0f8956310ae70c828f656b8cc5211b452c6da870f7f7598cdd8d003411b84b4561efa0918805b179c82c88d405dfb1a7e74d64dfacb143a37d6d63842f9e4d1b6031fa435486621a65e0e515411a44f8be8c6e395e81d174a25ce3261aeedd92703c1d78a885acda218dd7ca14cb8ff9ae63717127310467f0390a20ed753d69a415065b73462687dcb18ff02c1badfaca103ed4810fbfb976774a7d6b157a879a2282b39bd011b880f8eb3b2ee737a23239cfbc6fd69dbc7c03d84afb4272c42bd15fea290f6359d024e11c145a47e79287e0dd3a172b8da75f20be3aa8fa39e01de0e3ec13d81564f6476d4362844716f6a05afe3f65fa6b87be4cf25bf43bffae2fd6247e6c42e98ad323cf6e87d2daca95fe67c3c1be344953471a36ae23ea5caed438048b882696bfc4f502ebc4a0155bb64d0c6027e8628c3d9b0ab84b8c048696a15a72e7ab8ba927f6d3c83f9c3f27bd35624361110f9424fa426084c92114a84a462a1aaa57148d00b1c5b17c58f39faccd5f8494c60bfb5faf8f78edfa342eabb53e3477519c81c439d33bf4dbff3b80d384f1a636a773f2e78ec1548b51f528c96977fecf0181703d9d3061261826b0b998ba1d580a23bd626adf4aa6cef4d21bbc461a7999f8aa409a9a06f0fbf79581b65520202cdc1f9f5c89403d221a5c169d57357ada5c9a13a73cef8796b16c106ed5c9d8bf3629ed3cf1855468b787c9b938ebac9d5cae52ea9143f5afcd2a75a34bb87831ff3d6307aab1f197f8978a00fadc6f3fb7fa36088922e0934f28edb3235918ce63dc33188fbdd12cd1df9931de61e587c705e12ef7b1a42de460c61fc2b291316b2161a0c7c8e26032a441e4c2c67c8c595615979cf261a21caf93c307a7ba9b26355bf737911cea8b956e4727b11daa01db014766b642d9e0efff68ab91ead5bc200145337dff2f43b1f2edead28b5bf89e37d04d5db2b4a0870a3e0bd4e1e51c605dc00d6c8eaec0ac6d93ba47e5121eff4d6c1932bc27f635d673bc8f24aa777de7ba4ebf1d5c7f3dcc099306a01048f7cd8a16a97f11b31a1bc013de7fe8356214ab415f623b32917dc8efdea513ee2d518f7f3b4500c89e2576254cb3e798af21270672a3dfd8dc8ddf7370a9945659754aaa22a2ded21fb317a85a0d1d6a60f47fe89713d47f52f0f32819907611d6607a2f766e3c2b0135939d6620328a12fa2d2e95e18a5252d", &(0x7f0000001180)=""/149, 0x6, 0x10004, 0x0, 0xfffffffffffffffe}) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2203, &(0x7f0000000080)) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f310000000008004100727865001400330076657468305f7465616d0000000902020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000001dd4540000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900df19cf2425c3f40a3c7b272305330ceceb19f514937ba8c842f1fe158c0a866ea069039dc487818d46e95a2eefcae08e62d14ee98bc87bd53c69970db73303da221d7a77d35e621901925da4de3b2dd71bc2a7bbda4cac84200c40372130f71db99a85bc265680332173edfd71eeec81eefaf33756756b1a"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SCSI_RESET(r2, 0x2284, 0x0) 10:01:52 executing program 2: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) 10:01:52 executing program 5: r0 = epoll_create1(0x0) epoll_pwait2(r0, &(0x7f0000000080)=[{}, {}, {}], 0x3, &(0x7f00000000c0), &(0x7f0000000100)={[0xa274]}, 0x8) (async, rerun: 64) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) epoll_pwait2(r3, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], 0x7, &(0x7f00000001c0), &(0x7f0000000200)={[0x4]}, 0x8) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@deltaction={0x28, 0x31, 0x400, 0x70bd27, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x8000) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000180)) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@deltaction={0x28, 0x31, 0x400, 0x70bd27, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x8000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000180)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f310000000008004100727865001400330076657468305f7465616d0000000902020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000001dd4540000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900df19cf2425c3f40a3c7b272305330ceceb19f514937ba8c842f1fe158c0a866ea069039dc487818d46e95a2eefcae08e62d14ee98bc87bd53c69970db73303da221d7a77d35e621901925da4de3b2dd71bc2a7bbda4cac84200c40372130f71db99a85bc265680332173edfd71eeec81eefaf33756756b1a"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SCSI_RESET(r2, 0x2284, 0x0) 10:01:52 executing program 2: syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x472b02) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x4aa042) r1 = syz_io_uring_complete(0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000001240)={0x53, 0xfffffffffffffffb, 0x1000, 0x6, @buffer={0x0, 0xb0, &(0x7f00000000c0)=""/176}, &(0x7f0000000180)="df79f8b1dfce69d741860746843cc104039f6651ac9f1184fe8d194a914a3d9bd9fb4f077067f9e2be971087f97f9f374eff2b8e573c62dbe570f33cceeb60dd4702d67c0ef523a979a4630def6faf1e92d44a8fcf47e335ee82a8bcedf10e886bc2b3b14562d1233a921dce4fe52d3092ebbac5d329db6d2df72eab25d013a08d3cf9a4b4526565c64e148cd555d461073540e9394e5505cdb23688330ac4c4a8e5d00d5e6eb026a1633e2268d112367cd5c16da037ac1ed937dc3d251e348ca1ec815a26c9a6b31250c9f53c6380693c590b6328bf273d324f2e9014af07c34d03cf877f8780f760a062e1e0edfacf6565f7d73ab49f24fbb6d5b800b34fc2c55aac2bf96bf87f011442eb5c2c365a107f8eb7e7caf038e873395b963c45f5380826404a3abfec60892a12633c98386d705f16470271cfac2e111835131ccf790962c4a52f7c67fb731d1604ea26fb2dd7aa8ce1fb1fb372695172f66d3275b29174362df7f4535595303e8b55fb1351234461373f61d530f1eab0458e5dec7434c78017ef0a80dbdb601d558313410f8263a1244d847624ee45c709a089d0161c5cbf487cdda48c56babf95bea19428cb5dc854fb260cd93bf678fcbc02292edc51abb1db38b78ff10d47e843e092ef6f556f3dcc2e5ef853aedd760717fc0a7545b56bd5e3ad591f0580e03271a199213f9104eef79228900e7075f8e124aafbfe355707c85518ca2df769a0783f3e3fda28694efb3a54e8a8523900736fa9b9b3832c74f52abab8994def9c52dfc2f8099d6b61e6fe5762396c8cd7e543ec6f4c133be9d31b718654603c017d07812674343df681251fc5fdcdb4c7a505742689895b4ad360397ab0d6afb872351419e220d63e7cf2e16edfc189c8f0d40ea02bb4c830221f6c4079e430e5c6acec9fc21fbd79cbeff0cf172f08b5605a44e5ff719648f6fd1a87fb3537b8bf1ca561ab2c072cb1cc263513a8b1a3460c56db7ca32b251f619ef709465e29ec9515e9a225d58d4965aebd9c3217fbe36ecee9140ac1a231f5ac0de084324b681f314b5e7e03c0dab16090a8388ba4f71a87692f9d00b41499f666b27742872e5df96b699e6d0326a18df50753159d2c1a2bbf9a00f10f010e8b1ddee5b5b96aafc8b41ddb4354b1277ae949aefdf660a0e3917f8924ec58479eb943195a87a64ba9e34787c8db0ecfd2473f55138cc442622d516ea03575823a62b059faeb21b68503de70544b82bcd372d54612f4adaa3d3b5a2c5b952bdc7c0b8142fe22015d456db672b73affcf4d7d58aff74cb53fb54f64684e3ae0c7630de51c192eb18e31ee72e06db5fb69676cfaf2a3692d72ad1997d924fc80076257739efdacb697309b3db3e28cfb4f5388a84fd4bb1661c9dd6ab915e00d24410fdbf2b52a3cf2f1328a3857461856e4f2d5e924bb1b7f3c8e0ba7fae16567071b4f3df62c381fe5e432839926c0eed4eddfaf3345b15d3a4b171a7aa5bbb5929a3cef96f6301c89812ed7cd206efa623afa55eccdb675240d6989b127020b467f6929e16f97fac1222283771c7f80d7ad29b8123bab5146a8199e8f90312799003ea8f58ccb03823c56babd9c70ca6be3b5e95a6d5aca7038870be449753d756dc0c4e365d470a247d8c68d4194823eb5780e19e365edcc9281f25c8b567155a2dd94b0745436662a83a15ecf5f008c60db9ae4bf3426b4bb78cd2b411535e31742a9aa159e428c903a6d17a0ee61764119fd67ed81c4385b4f05e404ac678fcc6cd8349b6702018cfc2833e0cffdf3593ee4a7168581d7f1a320804e4433dddf280ca2e4d7c1e0e7ba13d4acae8c9c1bc300e03c398ffb62875ea9b9875fe5de333dd820dbc647dd70eda8c40a69732fcc54ea7965ff069d8cf079ff161a0842be2ca055ece8c1838c6d498cd9629cefb7f5ced8891e64f0c023388cb576e78a246c3f4199a5bcaf4686a1b531be1ca053544621a7f6c21c3c47cabfaafbe749c86aa3c51d237f8d14ca5f9671ef26be1cbdbb4305b80222d0fdb2e689333b81cfd295c02e0fd1131949ce6b5a28b895f7f12175b7b664b79824d6d45299633dbad5850675b929932bcc18adfde9a7b95e549d58c0dc7de6bd9503437d6b6df783171f684ac632efce0740e4d4fae5e87b6425e9da1d5165f44a6214a7330bd975581358a4b77049d211d67cb7ab9fd7d2cc75cf5685db77c1df0f54b310e310bac1ad97d4692a38166aeba508dae78e2e07f9ef81a5a4b29785cdb5e94c794e21827e276b573190d6e3369255fa0ddd2ce3e8bcd42876cc2a874faff3e07eec2cad2207f86e0396745949f97a8a63c63958b2f09fd4f1d3cac12b5c6bc358598fe94b773e3178f1f30a6738ba0c35e29fb537593a4131e916c6f261a2b86f90e8fd2c523ec7da25a64819316760e1653ae10e411174b7ebb2a8d9ff92f428f63eec7eec783af2ba7256c0469fbd7c18271443e0d1e5f2b09e0f168eeb7257677d41ba72c9632356ac4bd798c6bc21e5059dfa85561758b4e22b929655299cc37d2cd97a204047d506531ac2143493e7735a17477e5972e817fd52ecb19ac3e1817de11311e31515e5d880feb62952fc0d21af2e5c0dc57a3efa6f970c98a7546662a261f28231a0daca669db3dda5b833c89804a84349d5b157327ac533da36e9cfc7c07db41031dfff33fe3c8ffc41ec0dea5b96f4d08bf51e12d1586069960312798db7e6b161c0728536c6def225ae7a63b17644cf04e16d097e53c34ff40f3f0a2441fcc4bd566052cbc43ea72685b7d5b571a2b89b48ded4cfa74eeb06d27922a7e6ce24fe71535e0abdaf947b4b850e25e33b562f013c156b4287074583cbda60035073077bfea6877e123173253885bf2acb85f4535f3160cb013ef0b89b5e2894282b72feb097edbe0dbf93b59ea2913084f8e0fadd286c5b78724ebdf9608d01a8ec9db530ab50d6595321361fd5a2f08ec9d3abe81cfd692421d6132d8af9f48efd94827fdf4391f28122b98c4c7d7e44e826eb3dde0ed0beb61a1046203cbb198d1be688d3e926640bac025f9e1e45582cd110ef53e70f1fa0b6039aa4bec5c12de7f5e0c31bab40ee979efd01fb325c9949e78e286e82402d13a82da1ce08a8d5a5e818ff5f7860a07cd7f8fbdf4db8c8ef45a61046ac422ad4d3a7bece2475382df491d84f590b15245e846ac27cd8a2efbf9db0c9ce1609246596fc4c565b2c4a3a6974cf787869a6fabb2415a234398acd6e60483feea21a71518bc38705f02c3d6d9199c1ad6778d2c6dc709d4b13dd1bd8b029e1e704fd80338a1bcb233e6a36bb23c729d8919a6301d93173f4588badccbe96c32ec0d162f0919f0614e4761e8381e2b98a0926730db3e1114d43dfc01516346d2eb6fe4f92066cbec51aee790500f34363a62974288e9f952e02a41838748484e9468d29e373af015b6e11aa90ed0a10611caed8b2c800cc8b3b6be16478d0b4539455f9415ef47e64fc74134d2bdb4c27f861db40314a12517d86fc1a93c59352968a4b9fb878945ee9a8ee78a44cd6a88417e1be0354c2f5002e4b076330afc3a21837d81222a82e39636145d477a8c03bb79ec847739125600eb744e7c793c76c79e504e0661166f290ea203a2486e71428d14607fd653fa0390b113d38e8adb339f2f56ec33ec149853179e36dd976634f838e596e56215340a64c26664e301d14653d61dd81e6fbd48953533da8f4a1e60ae8b0bc6a8b0838d550e44de4f87bc2c1d23647093dc041905702d4422cc16b9cf12337f1b7a514cca2715c6bb5b26323d4b6904782ccb8d4c4894bddd80b7cacff86633ecb2e1afac78e572e313730db63acbd8fc91fbeebc1a809c336754de246bfdc38668ae7b1f25cfb99024209a7fc7ded639f6d630ecf04b92a9ffe98eae9befed1c030f998425fb36c765f87b1867dc816efdcf60e0f230f709e5a401539d3457e427720f18ab457b7d6d3e4e43f97501b66cb4827b7a3602833444471e1e42e1eda563736fa66e667b1bbe8d08f142b729e6c95cbe3619744fdd112be5cb7eb9be1b10922e243b184e29bc8e67fdbb0c9836b8daa1b1c9edeb8d718d089520312bb70c943ea9c932b4b0f133795ab37c15bb745a667e9a6fa4b704d899e42d3931c1adb194081e4bc472a429f270cee5b2f21dccfef699b34fd4f1564fc062984a00e7a84935a4c799eaa6d6d3e9e8c7723414c9e7ba947e23858ab3e8e44bd0bd3a9e0d301f515387934c5e0e8b37ea2525504ecb1e59f5f402cb732369c131c6543869c835488a3702c287c5d99bf5940d2db8a854d70148824373979874953525bbe5b86dfd86205f45482742d51a97bb68b6e1c65007fb037af24158aa9a298edc763ba7c37b2bebe8fe42a59788c078345b0da473c8febc99da6d3e4d72073ccb89c2e13115ae61609ead07f6019d544134ef759eb71c09939912ef26dd6299123d292e3af664b32bd1db0f0636a054b5be97d0e237a4073e15a3f9311776194c357e4a0d253ad856243f7618195dda14c55fcae5a5b1f97add0f8956310ae70c828f656b8cc5211b452c6da870f7f7598cdd8d003411b84b4561efa0918805b179c82c88d405dfb1a7e74d64dfacb143a37d6d63842f9e4d1b6031fa435486621a65e0e515411a44f8be8c6e395e81d174a25ce3261aeedd92703c1d78a885acda218dd7ca14cb8ff9ae63717127310467f0390a20ed753d69a415065b73462687dcb18ff02c1badfaca103ed4810fbfb976774a7d6b157a879a2282b39bd011b880f8eb3b2ee737a23239cfbc6fd69dbc7c03d84afb4272c42bd15fea290f6359d024e11c145a47e79287e0dd3a172b8da75f20be3aa8fa39e01de0e3ec13d81564f6476d4362844716f6a05afe3f65fa6b87be4cf25bf43bffae2fd6247e6c42e98ad323cf6e87d2daca95fe67c3c1be344953471a36ae23ea5caed438048b882696bfc4f502ebc4a0155bb64d0c6027e8628c3d9b0ab84b8c048696a15a72e7ab8ba927f6d3c83f9c3f27bd35624361110f9424fa426084c92114a84a462a1aaa57148d00b1c5b17c58f39faccd5f8494c60bfb5faf8f78edfa342eabb53e3477519c81c439d33bf4dbff3b80d384f1a636a773f2e78ec1548b51f528c96977fecf0181703d9d3061261826b0b998ba1d580a23bd626adf4aa6cef4d21bbc461a7999f8aa409a9a06f0fbf79581b65520202cdc1f9f5c89403d221a5c169d57357ada5c9a13a73cef8796b16c106ed5c9d8bf3629ed3cf1855468b787c9b938ebac9d5cae52ea9143f5afcd2a75a34bb87831ff3d6307aab1f197f8978a00fadc6f3fb7fa36088922e0934f28edb3235918ce63dc33188fbdd12cd1df9931de61e587c705e12ef7b1a42de460c61fc2b291316b2161a0c7c8e26032a441e4c2c67c8c595615979cf261a21caf93c307a7ba9b26355bf737911cea8b956e4727b11daa01db014766b642d9e0efff68ab91ead5bc200145337dff2f43b1f2edead28b5bf89e37d04d5db2b4a0870a3e0bd4e1e51c605dc00d6c8eaec0ac6d93ba47e5121eff4d6c1932bc27f635d673bc8f24aa777de7ba4ebf1d5c7f3dcc099306a01048f7cd8a16a97f11b31a1bc013de7fe8356214ab415f623b32917dc8efdea513ee2d518f7f3b4500c89e2576254cb3e798af21270672a3dfd8dc8ddf7370a9945659754aaa22a2ded21fb317a85a0d1d6a60f47fe89713d47f52f0f32819907611d6607a2f766e3c2b0135939d6620328a12fa2d2e95e18a5252d", &(0x7f0000001180)=""/149, 0x6, 0x10004, 0x0, 0xfffffffffffffffe}) ioctl$SG_GET_NUM_WAITING(r1, 0x2203, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x2, 0x4aa042) (async) syz_io_uring_complete(0x0) (async) ioctl$SG_IO(r0, 0x2285, &(0x7f0000001240)={0x53, 0xfffffffffffffffb, 0x1000, 0x6, @buffer={0x0, 0xb0, &(0x7f00000000c0)=""/176}, &(0x7f0000000180)="df79f8b1dfce69d741860746843cc104039f6651ac9f1184fe8d194a914a3d9bd9fb4f077067f9e2be971087f97f9f374eff2b8e573c62dbe570f33cceeb60dd4702d67c0ef523a979a4630def6faf1e92d44a8fcf47e335ee82a8bcedf10e886bc2b3b14562d1233a921dce4fe52d3092ebbac5d329db6d2df72eab25d013a08d3cf9a4b4526565c64e148cd555d461073540e9394e5505cdb23688330ac4c4a8e5d00d5e6eb026a1633e2268d112367cd5c16da037ac1ed937dc3d251e348ca1ec815a26c9a6b31250c9f53c6380693c590b6328bf273d324f2e9014af07c34d03cf877f8780f760a062e1e0edfacf6565f7d73ab49f24fbb6d5b800b34fc2c55aac2bf96bf87f011442eb5c2c365a107f8eb7e7caf038e873395b963c45f5380826404a3abfec60892a12633c98386d705f16470271cfac2e111835131ccf790962c4a52f7c67fb731d1604ea26fb2dd7aa8ce1fb1fb372695172f66d3275b29174362df7f4535595303e8b55fb1351234461373f61d530f1eab0458e5dec7434c78017ef0a80dbdb601d558313410f8263a1244d847624ee45c709a089d0161c5cbf487cdda48c56babf95bea19428cb5dc854fb260cd93bf678fcbc02292edc51abb1db38b78ff10d47e843e092ef6f556f3dcc2e5ef853aedd760717fc0a7545b56bd5e3ad591f0580e03271a199213f9104eef79228900e7075f8e124aafbfe355707c85518ca2df769a0783f3e3fda28694efb3a54e8a8523900736fa9b9b3832c74f52abab8994def9c52dfc2f8099d6b61e6fe5762396c8cd7e543ec6f4c133be9d31b718654603c017d07812674343df681251fc5fdcdb4c7a505742689895b4ad360397ab0d6afb872351419e220d63e7cf2e16edfc189c8f0d40ea02bb4c830221f6c4079e430e5c6acec9fc21fbd79cbeff0cf172f08b5605a44e5ff719648f6fd1a87fb3537b8bf1ca561ab2c072cb1cc263513a8b1a3460c56db7ca32b251f619ef709465e29ec9515e9a225d58d4965aebd9c3217fbe36ecee9140ac1a231f5ac0de084324b681f314b5e7e03c0dab16090a8388ba4f71a87692f9d00b41499f666b27742872e5df96b699e6d0326a18df50753159d2c1a2bbf9a00f10f010e8b1ddee5b5b96aafc8b41ddb4354b1277ae949aefdf660a0e3917f8924ec58479eb943195a87a64ba9e34787c8db0ecfd2473f55138cc442622d516ea03575823a62b059faeb21b68503de70544b82bcd372d54612f4adaa3d3b5a2c5b952bdc7c0b8142fe22015d456db672b73affcf4d7d58aff74cb53fb54f64684e3ae0c7630de51c192eb18e31ee72e06db5fb69676cfaf2a3692d72ad1997d924fc80076257739efdacb697309b3db3e28cfb4f5388a84fd4bb1661c9dd6ab915e00d24410fdbf2b52a3cf2f1328a3857461856e4f2d5e924bb1b7f3c8e0ba7fae16567071b4f3df62c381fe5e432839926c0eed4eddfaf3345b15d3a4b171a7aa5bbb5929a3cef96f6301c89812ed7cd206efa623afa55eccdb675240d6989b127020b467f6929e16f97fac1222283771c7f80d7ad29b8123bab5146a8199e8f90312799003ea8f58ccb03823c56babd9c70ca6be3b5e95a6d5aca7038870be449753d756dc0c4e365d470a247d8c68d4194823eb5780e19e365edcc9281f25c8b567155a2dd94b0745436662a83a15ecf5f008c60db9ae4bf3426b4bb78cd2b411535e31742a9aa159e428c903a6d17a0ee61764119fd67ed81c4385b4f05e404ac678fcc6cd8349b6702018cfc2833e0cffdf3593ee4a7168581d7f1a320804e4433dddf280ca2e4d7c1e0e7ba13d4acae8c9c1bc300e03c398ffb62875ea9b9875fe5de333dd820dbc647dd70eda8c40a69732fcc54ea7965ff069d8cf079ff161a0842be2ca055ece8c1838c6d498cd9629cefb7f5ced8891e64f0c023388cb576e78a246c3f4199a5bcaf4686a1b531be1ca053544621a7f6c21c3c47cabfaafbe749c86aa3c51d237f8d14ca5f9671ef26be1cbdbb4305b80222d0fdb2e689333b81cfd295c02e0fd1131949ce6b5a28b895f7f12175b7b664b79824d6d45299633dbad5850675b929932bcc18adfde9a7b95e549d58c0dc7de6bd9503437d6b6df783171f684ac632efce0740e4d4fae5e87b6425e9da1d5165f44a6214a7330bd975581358a4b77049d211d67cb7ab9fd7d2cc75cf5685db77c1df0f54b310e310bac1ad97d4692a38166aeba508dae78e2e07f9ef81a5a4b29785cdb5e94c794e21827e276b573190d6e3369255fa0ddd2ce3e8bcd42876cc2a874faff3e07eec2cad2207f86e0396745949f97a8a63c63958b2f09fd4f1d3cac12b5c6bc358598fe94b773e3178f1f30a6738ba0c35e29fb537593a4131e916c6f261a2b86f90e8fd2c523ec7da25a64819316760e1653ae10e411174b7ebb2a8d9ff92f428f63eec7eec783af2ba7256c0469fbd7c18271443e0d1e5f2b09e0f168eeb7257677d41ba72c9632356ac4bd798c6bc21e5059dfa85561758b4e22b929655299cc37d2cd97a204047d506531ac2143493e7735a17477e5972e817fd52ecb19ac3e1817de11311e31515e5d880feb62952fc0d21af2e5c0dc57a3efa6f970c98a7546662a261f28231a0daca669db3dda5b833c89804a84349d5b157327ac533da36e9cfc7c07db41031dfff33fe3c8ffc41ec0dea5b96f4d08bf51e12d1586069960312798db7e6b161c0728536c6def225ae7a63b17644cf04e16d097e53c34ff40f3f0a2441fcc4bd566052cbc43ea72685b7d5b571a2b89b48ded4cfa74eeb06d27922a7e6ce24fe71535e0abdaf947b4b850e25e33b562f013c156b4287074583cbda60035073077bfea6877e123173253885bf2acb85f4535f3160cb013ef0b89b5e2894282b72feb097edbe0dbf93b59ea2913084f8e0fadd286c5b78724ebdf9608d01a8ec9db530ab50d6595321361fd5a2f08ec9d3abe81cfd692421d6132d8af9f48efd94827fdf4391f28122b98c4c7d7e44e826eb3dde0ed0beb61a1046203cbb198d1be688d3e926640bac025f9e1e45582cd110ef53e70f1fa0b6039aa4bec5c12de7f5e0c31bab40ee979efd01fb325c9949e78e286e82402d13a82da1ce08a8d5a5e818ff5f7860a07cd7f8fbdf4db8c8ef45a61046ac422ad4d3a7bece2475382df491d84f590b15245e846ac27cd8a2efbf9db0c9ce1609246596fc4c565b2c4a3a6974cf787869a6fabb2415a234398acd6e60483feea21a71518bc38705f02c3d6d9199c1ad6778d2c6dc709d4b13dd1bd8b029e1e704fd80338a1bcb233e6a36bb23c729d8919a6301d93173f4588badccbe96c32ec0d162f0919f0614e4761e8381e2b98a0926730db3e1114d43dfc01516346d2eb6fe4f92066cbec51aee790500f34363a62974288e9f952e02a41838748484e9468d29e373af015b6e11aa90ed0a10611caed8b2c800cc8b3b6be16478d0b4539455f9415ef47e64fc74134d2bdb4c27f861db40314a12517d86fc1a93c59352968a4b9fb878945ee9a8ee78a44cd6a88417e1be0354c2f5002e4b076330afc3a21837d81222a82e39636145d477a8c03bb79ec847739125600eb744e7c793c76c79e504e0661166f290ea203a2486e71428d14607fd653fa0390b113d38e8adb339f2f56ec33ec149853179e36dd976634f838e596e56215340a64c26664e301d14653d61dd81e6fbd48953533da8f4a1e60ae8b0bc6a8b0838d550e44de4f87bc2c1d23647093dc041905702d4422cc16b9cf12337f1b7a514cca2715c6bb5b26323d4b6904782ccb8d4c4894bddd80b7cacff86633ecb2e1afac78e572e313730db63acbd8fc91fbeebc1a809c336754de246bfdc38668ae7b1f25cfb99024209a7fc7ded639f6d630ecf04b92a9ffe98eae9befed1c030f998425fb36c765f87b1867dc816efdcf60e0f230f709e5a401539d3457e427720f18ab457b7d6d3e4e43f97501b66cb4827b7a3602833444471e1e42e1eda563736fa66e667b1bbe8d08f142b729e6c95cbe3619744fdd112be5cb7eb9be1b10922e243b184e29bc8e67fdbb0c9836b8daa1b1c9edeb8d718d089520312bb70c943ea9c932b4b0f133795ab37c15bb745a667e9a6fa4b704d899e42d3931c1adb194081e4bc472a429f270cee5b2f21dccfef699b34fd4f1564fc062984a00e7a84935a4c799eaa6d6d3e9e8c7723414c9e7ba947e23858ab3e8e44bd0bd3a9e0d301f515387934c5e0e8b37ea2525504ecb1e59f5f402cb732369c131c6543869c835488a3702c287c5d99bf5940d2db8a854d70148824373979874953525bbe5b86dfd86205f45482742d51a97bb68b6e1c65007fb037af24158aa9a298edc763ba7c37b2bebe8fe42a59788c078345b0da473c8febc99da6d3e4d72073ccb89c2e13115ae61609ead07f6019d544134ef759eb71c09939912ef26dd6299123d292e3af664b32bd1db0f0636a054b5be97d0e237a4073e15a3f9311776194c357e4a0d253ad856243f7618195dda14c55fcae5a5b1f97add0f8956310ae70c828f656b8cc5211b452c6da870f7f7598cdd8d003411b84b4561efa0918805b179c82c88d405dfb1a7e74d64dfacb143a37d6d63842f9e4d1b6031fa435486621a65e0e515411a44f8be8c6e395e81d174a25ce3261aeedd92703c1d78a885acda218dd7ca14cb8ff9ae63717127310467f0390a20ed753d69a415065b73462687dcb18ff02c1badfaca103ed4810fbfb976774a7d6b157a879a2282b39bd011b880f8eb3b2ee737a23239cfbc6fd69dbc7c03d84afb4272c42bd15fea290f6359d024e11c145a47e79287e0dd3a172b8da75f20be3aa8fa39e01de0e3ec13d81564f6476d4362844716f6a05afe3f65fa6b87be4cf25bf43bffae2fd6247e6c42e98ad323cf6e87d2daca95fe67c3c1be344953471a36ae23ea5caed438048b882696bfc4f502ebc4a0155bb64d0c6027e8628c3d9b0ab84b8c048696a15a72e7ab8ba927f6d3c83f9c3f27bd35624361110f9424fa426084c92114a84a462a1aaa57148d00b1c5b17c58f39faccd5f8494c60bfb5faf8f78edfa342eabb53e3477519c81c439d33bf4dbff3b80d384f1a636a773f2e78ec1548b51f528c96977fecf0181703d9d3061261826b0b998ba1d580a23bd626adf4aa6cef4d21bbc461a7999f8aa409a9a06f0fbf79581b65520202cdc1f9f5c89403d221a5c169d57357ada5c9a13a73cef8796b16c106ed5c9d8bf3629ed3cf1855468b787c9b938ebac9d5cae52ea9143f5afcd2a75a34bb87831ff3d6307aab1f197f8978a00fadc6f3fb7fa36088922e0934f28edb3235918ce63dc33188fbdd12cd1df9931de61e587c705e12ef7b1a42de460c61fc2b291316b2161a0c7c8e26032a441e4c2c67c8c595615979cf261a21caf93c307a7ba9b26355bf737911cea8b956e4727b11daa01db014766b642d9e0efff68ab91ead5bc200145337dff2f43b1f2edead28b5bf89e37d04d5db2b4a0870a3e0bd4e1e51c605dc00d6c8eaec0ac6d93ba47e5121eff4d6c1932bc27f635d673bc8f24aa777de7ba4ebf1d5c7f3dcc099306a01048f7cd8a16a97f11b31a1bc013de7fe8356214ab415f623b32917dc8efdea513ee2d518f7f3b4500c89e2576254cb3e798af21270672a3dfd8dc8ddf7370a9945659754aaa22a2ded21fb317a85a0d1d6a60f47fe89713d47f52f0f32819907611d6607a2f766e3c2b0135939d6620328a12fa2d2e95e18a5252d", &(0x7f0000001180)=""/149, 0x6, 0x10004, 0x0, 0xfffffffffffffffe}) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2203, &(0x7f0000000080)) (async) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r3 = gettid() write$P9_RGETLOCK(r2, &(0x7f0000000080)={0x27, 0x37, 0x2, {0x1, 0x8, 0x3f, r3, 0x9, '/dev/sg#\x00'}}, 0x27) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f310000000008004100727865001400330076657468305f7465616d0000000902020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000001dd4540000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900df19cf2425c3f40a3c7b272305330ceceb19f514937ba8c842f1fe158c0a866ea069039dc487818d46e95a2eefcae08e62d14ee98bc87bd53c69970db73303da221d7a77d35e621901925da4de3b2dd71bc2a7bbda4cac84200c40372130f71db99a85bc265680332173edfd71eeec81eefaf33756756b1a"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async, rerun: 64) ioctl$SG_SCSI_RESET(r2, 0x2284, 0x0) (rerun: 64) 10:01:52 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) setsockopt$SO_J1939_SEND_PRIO(r4, 0x6b, 0x3, &(0x7f00000002c0)=0x1, 0x4) r5 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r5, 0x5) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r6, 0x1}, 0x14}}, 0x0) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x5c, r6, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1b}}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x1) 10:01:52 executing program 2: syz_open_dev$sg(0x0, 0xfffffffffffffff9, 0x472b02) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@deltaction={0x28, 0x31, 0x400, 0x70bd27, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x8000) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000180)) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@deltaction={0x28, 0x31, 0x400, 0x70bd27, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x8000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000180)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) sendmsg$can_j1939(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x1d, 0x0, 0x0, {0x1, 0x0, 0x3}, 0xfe}, 0x18, &(0x7f00000001c0)={&(0x7f00000000c0)="126b226586cc6dea41978374f82f2d3a5717e01a22541f6899f02f9fc2115c61a3251364f4feead4fb0949da3534e8901f014bf882d611f00e305a6e83eb09e506ad394bfab6c186551f5f505a9d6ff07f2aae9b433828f652c3f7540377869bd5a6d03da37252e5171d0639e9be251ce2f71f1325780ddabacbee96cb7f59eef524650ccbdb7cdb263d615cba8b1c775622cc574f58ce9c34f9bbaf8b56d1bb785fc6b3f714057f2e133d98b7fb3d6eee010c1318fa04ba190ab064cffef558bb9c6d6cd21451dff9286b01ccdeef2aa8be09633f1abd59a563d095ee30c394bc05c1091478de", 0xe7}, 0x1, 0x0, 0x0, 0x4811}, 0x4000) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000400)={r2}, 0x8) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000480)={0x0, @remote, @remote}, &(0x7f00000004c0)=0xc) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'syztnl1\x00', 0x0, 0x4, 0x7f, 0x3, 0x5, 0x60, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x80, 0x401, 0x7}}) r8 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r8, &(0x7f0000000040)={0x1d, r9}, 0x18) sendmsg$nl_route(r3, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)=@mpls_getnetconf={0x5c, 0x52, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x80}, @NETCONFA_IFINDEX={0x8, 0x1, r4}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x4}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x5}, @NETCONFA_IFINDEX={0x8}, @NETCONFA_IFINDEX={0x8, 0x1, r6}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8, 0x1, r9}, @NETCONFA_IFINDEX={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000084) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000000, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000400)) r1 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073b37a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a31000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a310000000008004100727865001400000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) io_uring_setup(0x659e, &(0x7f0000000480)={0x0, 0x4908, 0x1, 0x1, 0x93, 0x0, r3}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000005, 0x810, r4, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r3, 0x5385, &(0x7f0000000180)={0xf9, ""/249}) ioctl$PPPIOCSMRU(r3, 0x40047452, &(0x7f0000000440)=0x80000000) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000140)=0x6, 0x8) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r3 = gettid() write$P9_RGETLOCK(r2, &(0x7f0000000080)={0x27, 0x37, 0x2, {0x1, 0x8, 0x3f, r3, 0x9, '/dev/sg#\x00'}}, 0x27) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) gettid() (async) write$P9_RGETLOCK(r2, &(0x7f0000000080)={0x27, 0x37, 0x2, {0x1, 0x8, 0x3f, r3, 0x9, '/dev/sg#\x00'}}, 0x27) (async) 10:01:52 executing program 2: syz_open_dev$sg(0x0, 0xfffffffffffffff9, 0x472b02) 10:01:52 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async, rerun: 32) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async, rerun: 32) sendmsg$can_j1939(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x1d, 0x0, 0x0, {0x1, 0x0, 0x3}, 0xfe}, 0x18, &(0x7f00000001c0)={&(0x7f00000000c0)="126b226586cc6dea41978374f82f2d3a5717e01a22541f6899f02f9fc2115c61a3251364f4feead4fb0949da3534e8901f014bf882d611f00e305a6e83eb09e506ad394bfab6c186551f5f505a9d6ff07f2aae9b433828f652c3f7540377869bd5a6d03da37252e5171d0639e9be251ce2f71f1325780ddabacbee96cb7f59eef524650ccbdb7cdb263d615cba8b1c775622cc574f58ce9c34f9bbaf8b56d1bb785fc6b3f714057f2e133d98b7fb3d6eee010c1318fa04ba190ab064cffef558bb9c6d6cd21451dff9286b01ccdeef2aa8be09633f1abd59a563d095ee30c394bc05c1091478de", 0xe7}, 0x1, 0x0, 0x0, 0x4811}, 0x4000) (async) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000400)={r2}, 0x8) (async) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000480)={0x0, @remote, @remote}, &(0x7f00000004c0)=0xc) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'syztnl1\x00', 0x0, 0x4, 0x7f, 0x3, 0x5, 0x60, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x80, 0x401, 0x7}}) r8 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r8, &(0x7f0000000040)={0x1d, r9}, 0x18) (async) sendmsg$nl_route(r3, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)=@mpls_getnetconf={0x5c, 0x52, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x80}, @NETCONFA_IFINDEX={0x8, 0x1, r4}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x4}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x5}, @NETCONFA_IFINDEX={0x8}, @NETCONFA_IFINDEX={0x8, 0x1, r6}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8, 0x1, r9}, @NETCONFA_IFINDEX={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000084) 10:01:52 executing program 2: syz_open_dev$sg(0x0, 0xfffffffffffffff9, 0x472b02) 10:01:52 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000001c0)={0x0, @multicast1, @dev}, &(0x7f0000000080)=0xfffffffffffffd08) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl2\x00', r3, 0x4, 0x1f, 0x20, 0x4, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x7, 0x40, 0x201, 0x9}}) 10:01:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000000, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000400)) r1 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073b37a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a31000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a310000000008004100727865001400000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) io_uring_setup(0x659e, &(0x7f0000000480)={0x0, 0x4908, 0x1, 0x1, 0x93, 0x0, r3}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000005, 0x810, r4, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r3, 0x5385, &(0x7f0000000180)={0xf9, ""/249}) ioctl$PPPIOCSMRU(r3, 0x40047452, &(0x7f0000000440)=0x80000000) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000140)=0x6, 0x8) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) syz_open_dev$sg(&(0x7f0000000040), 0x10000000, 0x0) (async) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) (async) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000400)) (async) socket$isdn_base(0x22, 0x3, 0x0) (async) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073b37a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a31000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a310000000008004100727865001400000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) io_uring_setup(0x659e, &(0x7f0000000480)={0x0, 0x4908, 0x1, 0x1, 0x93, 0x0, r3}) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000005, 0x810, r4, 0x0) (async) ioctl$SCSI_IOCTL_PROBE_HOST(r3, 0x5385, &(0x7f0000000180)={0xf9, ""/249}) (async) ioctl$PPPIOCSMRU(r3, 0x40047452, &(0x7f0000000440)=0x80000000) (async) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000140)=0x6, 0x8) (async) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) (async) 10:01:52 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) r3 = gettid() write$P9_RGETLOCK(r2, &(0x7f0000000080)={0x27, 0x37, 0x2, {0x1, 0x8, 0x3f, r3, 0x9, '/dev/sg#\x00'}}, 0x27) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async, rerun: 32) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000001c0)={0x0, @multicast1, @dev}, &(0x7f0000000080)=0xfffffffffffffd08) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl2\x00', r3, 0x4, 0x1f, 0x20, 0x4, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x7, 0x40, 0x201, 0x9}}) 10:01:53 executing program 2: syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x472b02) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) sendmsg$can_j1939(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x1d, 0x0, 0x0, {0x1, 0x0, 0x3}, 0xfe}, 0x18, &(0x7f00000001c0)={&(0x7f00000000c0)="126b226586cc6dea41978374f82f2d3a5717e01a22541f6899f02f9fc2115c61a3251364f4feead4fb0949da3534e8901f014bf882d611f00e305a6e83eb09e506ad394bfab6c186551f5f505a9d6ff07f2aae9b433828f652c3f7540377869bd5a6d03da37252e5171d0639e9be251ce2f71f1325780ddabacbee96cb7f59eef524650ccbdb7cdb263d615cba8b1c775622cc574f58ce9c34f9bbaf8b56d1bb785fc6b3f714057f2e133d98b7fb3d6eee010c1318fa04ba190ab064cffef558bb9c6d6cd21451dff9286b01ccdeef2aa8be09633f1abd59a563d095ee30c394bc05c1091478de", 0xe7}, 0x1, 0x0, 0x0, 0x4811}, 0x4000) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000400)={r2}, 0x8) (async) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000480)={0x0, @remote, @remote}, &(0x7f00000004c0)=0xc) (async) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000580)={'ip6_vti0\x00', &(0x7f0000000500)={'syztnl1\x00', 0x0, 0x4, 0x7f, 0x3, 0x5, 0x60, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x80, 0x401, 0x7}}) (async) r8 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r8, &(0x7f0000000040)={0x1d, r9}, 0x18) (async) sendmsg$nl_route(r3, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)=@mpls_getnetconf={0x5c, 0x52, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x80}, @NETCONFA_IFINDEX={0x8, 0x1, r4}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x4}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x5}, @NETCONFA_IFINDEX={0x8}, @NETCONFA_IFINDEX={0x8, 0x1, r6}, @NETCONFA_IFINDEX={0x8, 0x1, r7}, @NETCONFA_IFINDEX={0x8, 0x1, r9}, @NETCONFA_IFINDEX={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000084) 10:01:53 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) (async) setsockopt$SO_J1939_SEND_PRIO(r4, 0x6b, 0x3, &(0x7f00000002c0)=0x1, 0x4) (async) r5 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r5, 0x5) (async) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r6, 0x1}, 0x14}}, 0x0) (async) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x5c, r6, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1b}}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x1) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000000, 0x0) (async) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) (async) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000400)) (async) r1 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073b37a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a31000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a310000000008004100727865001400000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) io_uring_setup(0x659e, &(0x7f0000000480)={0x0, 0x4908, 0x1, 0x1, 0x93, 0x0, r3}) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000005, 0x810, r4, 0x0) (async) ioctl$SCSI_IOCTL_PROBE_HOST(r3, 0x5385, &(0x7f0000000180)={0xf9, ""/249}) (async, rerun: 64) ioctl$PPPIOCSMRU(r3, 0x40047452, &(0x7f0000000440)=0x80000000) (async, rerun: 64) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000140)=0x6, 0x8) (async) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) 10:01:53 executing program 5: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000001c0)={0x0, @multicast1, @dev}, &(0x7f0000000080)=0xfffffffffffffd08) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl2\x00', r3, 0x4, 0x1f, 0x20, 0x4, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x7, 0x40, 0x201, 0x9}}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000001c0)={0x0, @multicast1, @dev}, &(0x7f0000000080)=0xfffffffffffffd08) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl2\x00', r3, 0x4, 0x1f, 0x20, 0x4, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x7, 0x40, 0x201, 0x9}}) (async) 10:01:53 executing program 2: syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x472b02) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="7a0b0000031404062cbd7000fedbdf250900020073797a310000000008004100736977001405000076657468315f000000000000001f65000900020073797a310000000008004100727880001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a3000000000080041007278655f0dc48100140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f774c4f3662952dd52ddaf0e8ca0a319b2488d7d9356de8a620"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f0000000100)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669000478d3950e3a288db620aeedebdabd07ff3e94fe5169f749625da78ae54d5c3329dabaa6656670af9cdd7ce21cce4b2da31c9fa788a07a497f7a7a8c368d8943595760d779d8b9"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000400)) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f00000000c0)) 10:01:53 executing program 5: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 1: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2201, &(0x7f0000000000)) ioctl$SG_SCSI_RESET(0xffffffffffffffff, 0x2284, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vcan0\x00'}) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(0xffffffffffffffff, 0x3) 10:01:53 executing program 1: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2201, &(0x7f0000000000)) ioctl$SG_SCSI_RESET(0xffffffffffffffff, 0x2284, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vcan0\x00'}) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(0xffffffffffffffff, 0x3) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) socket$nl_rdma(0x10, 0x3, 0x14) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r0}, 0x8) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async, rerun: 64) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) (async, rerun: 64) setsockopt$SO_J1939_SEND_PRIO(r4, 0x6b, 0x3, &(0x7f00000002c0)=0x1, 0x4) (async) r5 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) (async, rerun: 64) ioctl$SCSI_IOCTL_START_UNIT(r5, 0x5) (async) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r6, 0x1}, 0x14}}, 0x0) (async) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x5c, r6, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x1b}}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x1) 10:01:53 executing program 2: syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x472b02) 10:01:53 executing program 5: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x1267, &(0x7f0000000000)) (async) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x4000000000005, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) syz_io_uring_setup(0x5b1a, &(0x7f0000000400)={0x0, 0x3e7e, 0x4, 0x3, 0x10, 0x0, r3}, &(0x7f0000ffb000/0x5000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) syz_io_uring_complete(r6) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 1: ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_SCSI_RESET(0xffffffffffffffff, 0x2284, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vcan0\x00'}) (async) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(0xffffffffffffffff, 0x3) 10:01:53 executing program 2: syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x0) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) socket$nl_rdma(0x10, 0x3, 0x14) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="7a0b0000031404062cbd7000fedbdf250900020073797a310000000008004100736977001405000076657468315f000000000000001f65000900020073797a310000000008004100727880001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a3000000000080041007278655f0dc48100140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f774c4f3662952dd52ddaf0e8ca0a319b2488d7d9356de8a620"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f0000000100)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669000478d3950e3a288db620aeedebdabd07ff3e94fe5169f749625da78ae54d5c3329dabaa6656670af9cdd7ce21cce4b2da31c9fa788a07a497f7a7a8c368d8943595760d779d8b9"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000400)) (async) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f00000000c0)) 10:01:53 executing program 2: syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x0) 10:01:53 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000100), r0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000000c0)=0x2) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x8000000000000000, 0x5e7641) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000400)=@IORING_OP_POLL_REMOVE={0x7, 0x3, 0x0, 0x0, 0x0, 0x12345}, 0x80000001) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f00000000c0)) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x4000000000005, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) syz_io_uring_setup(0x5b1a, &(0x7f0000000400)={0x0, 0x3e7e, 0x4, 0x3, 0x10, 0x0, r3}, &(0x7f0000ffb000/0x5000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) syz_io_uring_complete(r6) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) socket$nl_rdma(0x10, 0x3, 0x14) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 2: syz_open_dev$sg(&(0x7f0000000080), 0xfffffffffffffff9, 0x0) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="7a0b0000031404062cbd7000fedbdf250900020073797a310000000008004100736977001405000076657468315f000000000000001f65000900020073797a310000000008004100727880001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a3000000000080041007278655f0dc48100140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f774c4f3662952dd52ddaf0e8ca0a319b2488d7d9356de8a620"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f0000000100)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(0x0, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(0x0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669000478d3950e3a288db620aeedebdabd07ff3e94fe5169f749625da78ae54d5c3329dabaa6656670af9cdd7ce21cce4b2da31c9fa788a07a497f7a7a8c368d8943595760d779d8b9"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 64) ioctl$SG_SET_RESERVED_SIZE(r3, 0x2275, &(0x7f0000000400)) (async) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_NUM_WAITING(r4, 0x227d, &(0x7f00000000c0)) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x4000000000005, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) (async) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) syz_io_uring_setup(0x5b1a, &(0x7f0000000400)={0x0, 0x3e7e, 0x4, 0x3, 0x10, 0x0, r3}, &(0x7f0000ffb000/0x5000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000480)) syz_io_uring_complete(r6) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x29, 0x2, 0x3f, 0x10000, 0x10, @loopback, @empty, 0x1, 0x1, 0x1, 0xffffffff}}) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f00000006c0)={0x20, 0x0, 0x220, 0x70bd2d, 0x25dfdbfd, {}, [{{0x8}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x200400c0}, 0x80) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r4 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r4, 0x0, 0x481, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="acdaa183f95e", 0x6}, {&(0x7f00000000c0)="df44137532bb2b1547300b7cfabf162421a0d16770254871c6b4b39f", 0x1c}], 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="072bd6fc3331b1b208c5ff72a347ef99d803e3f5e825dc84c36cad5435fc2da7fe6e3c9a25bb8021da5ac6b5c86b734b911fc21489149567e5"], 0x90}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r6, 0x1}, 0x14}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x5e94cdce0ea3c3be, 0x1f, 0x7, 0x5, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2, 0x10, 0x0, 0x7, 0x1}}) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r6, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @loopback}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x3c}}, 0x0) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0xe80) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x8000000000000000, 0x5e7641) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000400)=@IORING_OP_POLL_REMOVE={0x7, 0x3, 0x0, 0x0, 0x0, 0x12345}, 0x80000001) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f00000000c0)) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) (async, rerun: 64) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (rerun: 64) 10:01:53 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000100), r0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000000c0)=0x2) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x400200) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_complete(0x0) write$selinux_attr(r3, &(0x7f00000000c0)='system_u:object_r:apt_var_log_t:s0\x00', 0x23) ioctl$SG_SET_FORCE_PACK_ID(r3, 0x227b, &(0x7f0000000080)) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900420073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900fd993a6035ccbc7326ea3ade48d577ccb97c079a40beec44c9c26156dbc138886ff8f4685383e7fa0cbd1caf5a321b777574336cb0c097123698de5c314bdeb9da54d84f97259cb8520a738b5efb7c18cebf1411c7edd8a8017600d6c0eb4f288a03335f9c93caa203e1e90f7a0a2037d02ff9c5e7fe4f9de0b02d4bafc29c3a7f85a19172b805a5ae2d7dd2d73a40a5e6881c75503f7473a3a90162409e592fa95fe338ea5a264668fb92e3dd34834097187a19cb5d9edeaa2f6dfccfca9c3794c6ccd0a53740667d9dc7493f23220b9e50aa39b05c84a37aad3e9ca12581cea310cd87d433015582838a26fbd921a676b15b0a27fd18bb541af5e739ea16b81090"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0xe80) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x8000000000000000, 0x5e7641) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) syz_io_uring_submit(r1, r3, &(0x7f0000000400)=@IORING_OP_POLL_REMOVE={0x7, 0x3, 0x0, 0x0, 0x0, 0x12345}, 0x80000001) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f00000000c0)) 10:01:53 executing program 2: r0 = socket$pppoe(0x18, 0x1, 0x0) syz_io_uring_setup(0x23bd, &(0x7f00000000c0)={0x0, 0xce88, 0x1, 0x1, 0x2fa}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000140), &(0x7f0000000180)=0x0) syz_io_uring_submit(0x0, r1, &(0x7f00000001c0)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x2, 0x0, @fd_index=0x5, 0x9, 0x0, 0x9, 0x0, 0x1}, 0x44) ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000000080)=0x9) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x6000003, 0x4010, r2, 0x10000000) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1000004980c9181d3ac1a1b2192c17f900031404062cbd7000feccdf25f1f5db045bee86d9dc92e5c59eb45baa5495bdf42efb487567c8e30e9d837d44a541404b86346ee9a6355c8340535de083d27c648f515727bf7031023befee68bbd4ee169c20b2058a46e6fd13a2f4b00c8962056dd63b2cee"], 0x10}, 0x1, 0x0, 0x0, 0x24040811}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x80010, r2, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2}, 0x10) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0xe80) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffd, 0xe80) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) 10:01:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_void(r2, 0x1, 0x3f, 0x0, 0x0) r3 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x400200) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_complete(0x0) write$selinux_attr(r3, &(0x7f00000000c0)='system_u:object_r:apt_var_log_t:s0\x00', 0x23) ioctl$SG_SET_FORCE_PACK_ID(r3, 0x227b, &(0x7f0000000080)) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900420073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900fd993a6035ccbc7326ea3ade48d577ccb97c079a40beec44c9c26156dbc138886ff8f4685383e7fa0cbd1caf5a321b777574336cb0c097123698de5c314bdeb9da54d84f97259cb8520a738b5efb7c18cebf1411c7edd8a8017600d6c0eb4f288a03335f9c93caa203e1e90f7a0a2037d02ff9c5e7fe4f9de0b02d4bafc29c3a7f85a19172b805a5ae2d7dd2d73a40a5e6881c75503f7473a3a90162409e592fa95fe338ea5a264668fb92e3dd34834097187a19cb5d9edeaa2f6dfccfca9c3794c6ccd0a53740667d9dc7493f23220b9e50aa39b05c84a37aad3e9ca12581cea310cd87d433015582838a26fbd921a676b15b0a27fd18bb541af5e739ea16b81090"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x400200) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_complete(0x0) (async) write$selinux_attr(r3, &(0x7f00000000c0)='system_u:object_r:apt_var_log_t:s0\x00', 0x23) (async) ioctl$SG_SET_FORCE_PACK_ID(r3, 0x227b, &(0x7f0000000080)) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900420073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900fd993a6035ccbc7326ea3ade48d577ccb97c079a40beec44c9c26156dbc138886ff8f4685383e7fa0cbd1caf5a321b777574336cb0c097123698de5c314bdeb9da54d84f97259cb8520a738b5efb7c18cebf1411c7edd8a8017600d6c0eb4f288a03335f9c93caa203e1e90f7a0a2037d02ff9c5e7fe4f9de0b02d4bafc29c3a7f85a19172b805a5ae2d7dd2d73a40a5e6881c75503f7473a3a90162409e592fa95fe338ea5a264668fb92e3dd34834097187a19cb5d9edeaa2f6dfccfca9c3794c6ccd0a53740667d9dc7493f23220b9e50aa39b05c84a37aad3e9ca12581cea310cd87d433015582838a26fbd921a676b15b0a27fd18bb541af5e739ea16b81090"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) (async) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x60003) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x7ff, 0x101040) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) syz_io_uring_submit(0x0, 0x0, &(0x7f00000012c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x4, 0x0, 0x0, 0x0, &(0x7f0000001280)={r2, r3+60000000}, 0x1, 0x1}, 0xa62) ioctl$SG_IO(r1, 0x2285, &(0x7f00000001c0)={0x53, 0xfffffffffffffffd, 0x1a, 0x1, @scatter={0x1, 0x0, &(0x7f0000001240)=[{&(0x7f0000000240)=""/4096, 0x1000}]}, &(0x7f0000000100)="2c0367bff5fa3a6b0b5000e668a6a75355fc74eceb0268df0a86", &(0x7f0000000140)=""/52, 0x8000, 0x7, 0xffffffffffffffff, &(0x7f0000000180)}) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x6000003, 0x4010, r2, 0x10000000) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1000004980c9181d3ac1a1b2192c17f900031404062cbd7000feccdf25f1f5db045bee86d9dc92e5c59eb45baa5495bdf42efb487567c8e30e9d837d44a541404b86346ee9a6355c8340535de083d27c648f515727bf7031023befee68bbd4ee169c20b2058a46e6fd13a2f4b00c8962056dd63b2cee"], 0x10}, 0x1, 0x0, 0x0, 0x24040811}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x80010, r2, 0x0) (async, rerun: 32) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2}, 0x10) 10:01:53 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000100), r0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000000c0)=0x2) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:53 executing program 0: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000012c0)={'sit0\x00', &(0x7f0000001240)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2}}) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r2, 0x2203, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r1, 0x4, 0x0, 0x80, 0xfffffffe, 0x40, @mcast1, @local, 0x7, 0x10, 0x1000, 0x40}}) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x400200) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_complete(0x0) write$selinux_attr(r3, &(0x7f00000000c0)='system_u:object_r:apt_var_log_t:s0\x00', 0x23) (async, rerun: 64) ioctl$SG_SET_FORCE_PACK_ID(r3, 0x227b, &(0x7f0000000080)) (async, rerun: 64) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900420073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900fd993a6035ccbc7326ea3ade48d577ccb97c079a40beec44c9c26156dbc138886ff8f4685383e7fa0cbd1caf5a321b777574336cb0c097123698de5c314bdeb9da54d84f97259cb8520a738b5efb7c18cebf1411c7edd8a8017600d6c0eb4f288a03335f9c93caa203e1e90f7a0a2037d02ff9c5e7fe4f9de0b02d4bafc29c3a7f85a19172b805a5ae2d7dd2d73a40a5e6881c75503f7473a3a90162409e592fa95fe338ea5a264668fb92e3dd34834097187a19cb5d9edeaa2f6dfccfca9c3794c6ccd0a53740667d9dc7493f23220b9e50aa39b05c84a37aad3e9ca12581cea310cd87d433015582838a26fbd921a676b15b0a27fd18bb541af5e739ea16b81090"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (rerun: 32) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x60003) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x7ff, 0x101040) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) syz_io_uring_submit(0x0, 0x0, &(0x7f00000012c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x4, 0x0, 0x0, 0x0, &(0x7f0000001280)={r2, r3+60000000}, 0x1, 0x1}, 0xa62) (async) ioctl$SG_IO(r1, 0x2285, &(0x7f00000001c0)={0x53, 0xfffffffffffffffd, 0x1a, 0x1, @scatter={0x1, 0x0, &(0x7f0000001240)=[{&(0x7f0000000240)=""/4096, 0x1000}]}, &(0x7f0000000100)="2c0367bff5fa3a6b0b5000e668a6a75355fc74eceb0268df0a86", &(0x7f0000000140)=""/52, 0x8000, 0x7, 0xffffffffffffffff, &(0x7f0000000180)}) 10:01:53 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f00000000c0)=0x1, 0x8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'caif0\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) accept4$llc(r2, 0x0, &(0x7f0000000100), 0x800) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6, 0x8010, r0, 0x8000000) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x114, &(0x7f0000000400), 0x0, 0x4) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x6000003, 0x4010, r2, 0x10000000) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1000004980c9181d3ac1a1b2192c17f900031404062cbd7000feccdf25f1f5db045bee86d9dc92e5c59eb45baa5495bdf42efb487567c8e30e9d837d44a541404b86346ee9a6355c8340535de083d27c648f515727bf7031023befee68bbd4ee169c20b2058a46e6fd13a2f4b00c8962056dd63b2cee"], 0x10}, 0x1, 0x0, 0x0, 0x24040811}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x80010, r2, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2}, 0x10) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000080)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) mmap$IORING_OFF_SQES(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x6000003, 0x4010, r2, 0x10000000) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1000004980c9181d3ac1a1b2192c17f900031404062cbd7000feccdf25f1f5db045bee86d9dc92e5c59eb45baa5495bdf42efb487567c8e30e9d837d44a541404b86346ee9a6355c8340535de083d27c648f515727bf7031023befee68bbd4ee169c20b2058a46e6fd13a2f4b00c8962056dd63b2cee"], 0x10}, 0x1, 0x0, 0x0, 0x24040811}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x80010, r2, 0x0) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2}, 0x10) (async) 10:01:53 executing program 0: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000012c0)={'sit0\x00', &(0x7f0000001240)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2}}) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r2, 0x2203, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r1, 0x4, 0x0, 0x80, 0xfffffffe, 0x40, @mcast1, @local, 0x7, 0x10, 0x1000, 0x40}}) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000012c0)={'sit0\x00', &(0x7f0000001240)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2}}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2203, &(0x7f0000000000)) (async) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r1, 0x4, 0x0, 0x80, 0xfffffffe, 0x40, @mcast1, @local, 0x7, 0x10, 0x1000, 0x40}}) (async) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x6, 0x60003) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x7ff, 0x101040) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) syz_io_uring_submit(0x0, 0x0, &(0x7f00000012c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x4, 0x0, 0x0, 0x0, &(0x7f0000001280)={r2, r3+60000000}, 0x1, 0x1}, 0xa62) (async) ioctl$SG_IO(r1, 0x2285, &(0x7f00000001c0)={0x53, 0xfffffffffffffffd, 0x1a, 0x1, @scatter={0x1, 0x0, &(0x7f0000001240)=[{&(0x7f0000000240)=""/4096, 0x1000}]}, &(0x7f0000000100)="2c0367bff5fa3a6b0b5000e668a6a75355fc74eceb0268df0a86", &(0x7f0000000140)=""/52, 0x8000, 0x7, 0xffffffffffffffff, &(0x7f0000000180)}) 10:01:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000001100010025bd7000fcdbdf258b1daec40134"], 0x2c}}, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x800) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xddc5, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x5413, &(0x7f0000000140)={0x0, 0x80081d7, 0x0, 0x40, 0x323, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:53 executing program 4: sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44001}, 0x800) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xddc5, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x5413, &(0x7f0000000140)={0x0, 0x80081d7, 0x0, 0x40, 0x323, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0xddc5, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x5413, &(0x7f0000000140)={0x0, 0x80081d7, 0x0, 0x40, 0x323, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) [ 3390.543109][T31256] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'. 10:01:53 executing program 0: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000012c0)={'sit0\x00', &(0x7f0000001240)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2}}) (async) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2203, &(0x7f0000000000)) (async) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r1, 0x4, 0x0, 0x80, 0xfffffffe, 0x40, @mcast1, @local, 0x7, 0x10, 0x1000, 0x40}}) 10:01:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000001100010025bd7000fcdbdf258b1daec40134"], 0x2c}}, 0x0) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x800) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 4: sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44001}, 0x800) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xddc5, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x5413, &(0x7f0000000140)={0x0, 0x80081d7, 0x0, 0x40, 0x323, 0x0, r2}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:53 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f00000000c0)=0x1, 0x8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'caif0\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) accept4$llc(r2, 0x0, &(0x7f0000000100), 0x800) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6, 0x8010, r0, 0x8000000) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x114, &(0x7f0000000400), 0x0, 0x4) 10:01:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000001100010025bd7000fcdbdf258b1daec40134"], 0x2c}}, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x800) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 0: sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1bebffe32bcf18f833438efa70da54cf4b50eee669b6b87e", @ANYRES16=0x0, @ANYBLOB="000128bd7000fcdbdf25020000000800080000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:53 executing program 4: sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44001}, 0x800) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) [ 3390.697636][T31274] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.5'. 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x71eb, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_vlan\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0xfffffffffffffdf2}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000804) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f0000000080)) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4, 0x10, r3, 0x0) syz_io_uring_submit(r5, r4, &(0x7f00000000c0)=@IORING_OP_FSYNC={0x3, 0x1, 0x0, @fd_index=0xa, 0x0, 0x0, 0x0, 0x0, 0x1}, 0xd4ee) 10:01:53 executing program 0: sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1bebffe32bcf18f833438efa70da54cf4b50eee669b6b87e", @ANYRES16=0x0, @ANYBLOB="000128bd7000fcdbdf25020000000800080000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1bebffe32bcf18f833438efa70da54cf4b50eee669b6b87e", @ANYRES16=0x0, @ANYBLOB="000128bd7000fcdbdf25020000000800080000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) 10:01:53 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x40080, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f00000000c0)) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 3: ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x4, 0xec, 0x1, 0xd8ce, 0x4a, @ipv4={'\x00', '\xff\xff', @empty}, @loopback, 0x7, 0x1, 0x200, 0x800}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x4, 0x5, 0x81, 0x5, 0xe, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x20, 0x7800, 0x3}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'batadv_slave_1\x00', 0x0}) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) r9 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r9, &(0x7f0000000040)={0x1d, r10}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x2f, 0x2, 0x2, 0xb86, 0x79, @local, @dev={0xfe, 0x80, '\x00', 0x3}, 0x7, 0xbe22bad6301dde3, 0x8, 0x4}}) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000c00)={&(0x7f0000000400)={0x7d0, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8}, {0x170, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r0}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x1f, 0x1, 0x0, 0x2}, {0x7, 0x0, 0x7, 0x4}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xb3}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x1bc, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8001}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x1, 0x0, 0x4, 0x1ff}, {0x1, 0x89, 0x7f, 0xffff}, {0x7fff, 0x3, 0x81, 0x2}, {0xfffd, 0x81, 0x4, 0x2}]}}}]}}, {{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1db7}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}, {{0x8}, {0x78, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x170, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8001}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x3, 0x3, 0x3, 0xffff}, {0x2895, 0xf7, 0x1f, 0x80000}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}]}}]}, 0x7d0}, 0x1, 0x0, 0x0, 0x40885}, 0x1) r12 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x470041, 0x0) write$P9_RLERRORu(r12, &(0x7f00000001c0)=ANY=[@ANYBLOB="c0000000070002b300007f2b28f51d7a7b6e71bc16fef3b5c04141f6f2225079ded3cecceb5e9c5ff0e8dff97ec86e32929f6305fa21eb042549d9650a7e7d3b2ce9d154e1270c184bd67336bbf0bf0f4fbb961bb6e8d7f861019a761dac4fd86b1e16ed9224f8ea5ede75252d3494a0776458c192605212fd8cd3e4a437d0f71dd676ad55f12e47378e76e7998842038314af3f9d868b10d8bc2285b5bc2565fc941cfd4b854582ca49a5ee463df1ea5b50c488daac3b680b0000000000000003"], 0xc0) 10:01:53 executing program 0: sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1bebffe32bcf18f833438efa70da54cf4b50eee669b6b87e", @ANYRES16=0x0, @ANYBLOB="000128bd7000fcdbdf25020000000800080000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x71eb, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_vlan\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0xfffffffffffffdf2}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000804) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f0000000080)) (async) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4, 0x10, r3, 0x0) syz_io_uring_submit(r5, r4, &(0x7f00000000c0)=@IORING_OP_FSYNC={0x3, 0x1, 0x0, @fd_index=0xa, 0x0, 0x0, 0x0, 0x0, 0x1}, 0xd4ee) 10:01:53 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x40080, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f00000000c0)) (rerun: 32) 10:01:53 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f00000000c0)=0x1, 0x8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'caif0\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) accept4$llc(r2, 0x0, &(0x7f0000000100), 0x800) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6, 0x8010, r0, 0x8000000) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x114, &(0x7f0000000400), 0x0, 0x4) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:53 executing program 3: ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x4, 0xec, 0x1, 0xd8ce, 0x4a, @ipv4={'\x00', '\xff\xff', @empty}, @loopback, 0x7, 0x1, 0x200, 0x800}}) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x4, 0x5, 0x81, 0x5, 0xe, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x20, 0x7800, 0x3}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'batadv_slave_1\x00', 0x0}) (async) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) (async) r9 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r9, &(0x7f0000000040)={0x1d, r10}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x2f, 0x2, 0x2, 0xb86, 0x79, @local, @dev={0xfe, 0x80, '\x00', 0x3}, 0x7, 0xbe22bad6301dde3, 0x8, 0x4}}) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000c00)={&(0x7f0000000400)={0x7d0, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8}, {0x170, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r0}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x1f, 0x1, 0x0, 0x2}, {0x7, 0x0, 0x7, 0x4}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xb3}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x1bc, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8001}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x1, 0x0, 0x4, 0x1ff}, {0x1, 0x89, 0x7f, 0xffff}, {0x7fff, 0x3, 0x81, 0x2}, {0xfffd, 0x81, 0x4, 0x2}]}}}]}}, {{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1db7}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}, {{0x8}, {0x78, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x170, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8001}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x3, 0x3, 0x3, 0xffff}, {0x2895, 0xf7, 0x1f, 0x80000}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}]}}]}, 0x7d0}, 0x1, 0x0, 0x0, 0x40885}, 0x1) (async) r12 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x470041, 0x0) write$P9_RLERRORu(r12, &(0x7f00000001c0)=ANY=[@ANYBLOB="c0000000070002b300007f2b28f51d7a7b6e71bc16fef3b5c04141f6f2225079ded3cecceb5e9c5ff0e8dff97ec86e32929f6305fa21eb042549d9650a7e7d3b2ce9d154e1270c184bd67336bbf0bf0f4fbb961bb6e8d7f861019a761dac4fd86b1e16ed9224f8ea5ede75252d3494a0776458c192605212fd8cd3e4a437d0f71dd676ad55f12e47378e76e7998842038314af3f9d868b10d8bc2285b5bc2565fc941cfd4b854582ca49a5ee463df1ea5b50c488daac3b680b0000000000000003"], 0xc0) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000000c0)=0x77) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x71eb, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)=0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_vlan\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0xfffffffffffffdf2}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000804) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f0000000080)) (async) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4, 0x10, r3, 0x0) syz_io_uring_submit(r5, r4, &(0x7f00000000c0)=@IORING_OP_FSYNC={0x3, 0x1, 0x0, @fd_index=0xa, 0x0, 0x0, 0x0, 0x0, 0x1}, 0xd4ee) 10:01:53 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x40080, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f00000000c0)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x40080, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f00000000c0)) (async) 10:01:53 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x7, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) 10:01:53 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x8271, 0x12000) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:53 executing program 3: ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x4, 0xec, 0x1, 0xd8ce, 0x4a, @ipv4={'\x00', '\xff\xff', @empty}, @loopback, 0x7, 0x1, 0x200, 0x800}}) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x4, 0x5, 0x81, 0x5, 0xe, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x20, 0x7800, 0x3}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'batadv_slave_1\x00', 0x0}) (async) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) (async) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) (async) r9 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r9, &(0x7f0000000040)={0x1d, r10}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x2f, 0x2, 0x2, 0xb86, 0x79, @local, @dev={0xfe, 0x80, '\x00', 0x3}, 0x7, 0xbe22bad6301dde3, 0x8, 0x4}}) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000c40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000c00)={&(0x7f0000000400)={0x7d0, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8}, {0x170, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r0}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x1f, 0x1, 0x0, 0x2}, {0x7, 0x0, 0x7, 0x4}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xb3}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}, {{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x1bc, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8001}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x1, 0x0, 0x4, 0x1ff}, {0x1, 0x89, 0x7f, 0xffff}, {0x7fff, 0x3, 0x81, 0x2}, {0xfffd, 0x81, 0x4, 0x2}]}}}]}}, {{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1db7}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}, {{0x8}, {0x78, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}, {{0x8}, {0x170, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8001}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x3, 0x3, 0x3, 0xffff}, {0x2895, 0xf7, 0x1f, 0x80000}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}]}}]}, 0x7d0}, 0x1, 0x0, 0x0, 0x40885}, 0x1) (async) r12 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x470041, 0x0) write$P9_RLERRORu(r12, &(0x7f00000001c0)=ANY=[@ANYBLOB="c0000000070002b300007f2b28f51d7a7b6e71bc16fef3b5c04141f6f2225079ded3cecceb5e9c5ff0e8dff97ec86e32929f6305fa21eb042549d9650a7e7d3b2ce9d154e1270c184bd67336bbf0bf0f4fbb961bb6e8d7f861019a761dac4fd86b1e16ed9224f8ea5ede75252d3494a0776458c192605212fd8cd3e4a437d0f71dd676ad55f12e47378e76e7998842038314af3f9d868b10d8bc2285b5bc2565fc941cfd4b854582ca49a5ee463df1ea5b50c488daac3b680b0000000000000003"], 0xc0) 10:01:53 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000000c0)=0x77) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000000c0)=0x77) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) (async) 10:01:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) 10:01:53 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64=r1, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC=r1, @ANYRES64=r1, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT=r1], 0x16) 10:01:54 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64=r1, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC=r1, @ANYRES64=r1, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT=r1], 0x16) 10:01:54 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) socket$kcm(0x29, 0x7, 0x0) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x2, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a230000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865006cbcbae376657468305f746f5f7465616d0000000900020073797a320000000008004500736977001400330003000000636930ff7f000000000000000900020073797a30000000000a0041007278650014003300604004a66c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a320000000008004100736977001400330000653e875900000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) ioctl$TFD_IOC_SET_TICKS(r2, 0x40085400, &(0x7f0000000080)=0x8) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669d9ba9e817c42bd4505ea15d9a2cd4612b13e2d6bd5b8549940a27b0ecee3873152471ce4045a57ee1d4d0548f31dfbe74ae1b087be819ee733bbd9a25b0dc1c51202184ea681c68d045fff4bcb0de7422a28dab57b80dd95e700605a435f9d7a8e6848ffe24c0d88dcc5ad2372dcf3015495ef6566c55c68b89abc78fd8a1ef4ca6cf0c98f089a"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x6ebcaa77e76cb250, r4, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="6300000043000000090000002dae6e22daab14ef9d497208a8517d45bc01cc145ce5aaf87060e525305035697ed88e7f161a0bc4d7c9c0f6529d18c1804edb8f99ba79960d502a0080223a8feabe12a06a5879a7b11d567242945cf3feae3f43d5"]) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) 10:01:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000000c0)=0x77) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) 10:01:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async, rerun: 32) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) (rerun: 32) 10:01:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x8271, 0x12000) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:54 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async, rerun: 64) r1 = socket$pptp(0x18, 0x1, 0x2) (rerun: 64) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) (async, rerun: 32) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64=r1, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC=r1, @ANYRES64=r1, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT=r1], 0x16) (rerun: 32) 10:01:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x8271, 0x12000) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) 10:01:54 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) socket$kcm(0x29, 0x7, 0x0) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x2, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a230000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865006cbcbae376657468305f746f5f7465616d0000000900020073797a320000000008004500736977001400330003000000636930ff7f000000000000000900020073797a30000000000a0041007278650014003300604004a66c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a320000000008004100736977001400330000653e875900000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) ioctl$TFD_IOC_SET_TICKS(r2, 0x40085400, &(0x7f0000000080)=0x8) (async) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669d9ba9e817c42bd4505ea15d9a2cd4612b13e2d6bd5b8549940a27b0ecee3873152471ce4045a57ee1d4d0548f31dfbe74ae1b087be819ee733bbd9a25b0dc1c51202184ea681c68d045fff4bcb0de7422a28dab57b80dd95e700605a435f9d7a8e6848ffe24c0d88dcc5ad2372dcf3015495ef6566c55c68b89abc78fd8a1ef4ca6cf0c98f089a"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x6ebcaa77e76cb250, r4, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="6300000043000000090000002dae6e22daab14ef9d497208a8517d45bc01cc145ce5aaf87060e525305035697ed88e7f161a0bc4d7c9c0f6529d18c1804edb8f99ba79960d502a0080223a8feabe12a06a5879a7b11d567242945cf3feae3f43d5"]) (async) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) 10:01:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_SG_TABLESIZE(0xffffffffffffffff, 0x227f, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) 10:01:54 executing program 5: r0 = syz_io_uring_complete(0x0) write$P9_RRENAME(r0, &(0x7f0000000080)={0x7, 0x15, 0x1}, 0x7) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) socket$pppoe(0x18, 0x1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) getsockopt$SO_J1939_PROMISC(r2, 0x6b, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x4) 10:01:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) syz_io_uring_complete(r1) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r3 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r3, 0x1, 0x24, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x19) 10:01:54 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64=r1, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC=r1, @ANYRES64=r1, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT=r1], 0x16) 10:01:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_SG_TABLESIZE(0xffffffffffffffff, 0x227f, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async, rerun: 64) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) 10:01:54 executing program 5: r0 = syz_io_uring_complete(0x0) write$P9_RRENAME(r0, &(0x7f0000000080)={0x7, 0x15, 0x1}, 0x7) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) socket$pppoe(0x18, 0x1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) getsockopt$SO_J1939_PROMISC(r2, 0x6b, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x4) syz_io_uring_complete(0x0) (async) write$P9_RRENAME(r0, &(0x7f0000000080)={0x7, 0x15, 0x1}, 0x7) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) socket$pppoe(0x18, 0x1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) (async) bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) (async) getsockopt$SO_J1939_PROMISC(r2, 0x6b, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async) 10:01:54 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) socket$kcm(0x29, 0x7, 0x0) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x2, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a230000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865006cbcbae376657468305f746f5f7465616d0000000900020073797a320000000008004500736977001400330003000000636930ff7f000000000000000900020073797a30000000000a0041007278650014003300604004a66c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a320000000008004100736977001400330000653e875900000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) ioctl$TFD_IOC_SET_TICKS(r2, 0x40085400, &(0x7f0000000080)=0x8) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) r4 = syz_io_uring_complete(r3) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f77696669d9ba9e817c42bd4505ea15d9a2cd4612b13e2d6bd5b8549940a27b0ecee3873152471ce4045a57ee1d4d0548f31dfbe74ae1b087be819ee733bbd9a25b0dc1c51202184ea681c68d045fff4bcb0de7422a28dab57b80dd95e700605a435f9d7a8e6848ffe24c0d88dcc5ad2372dcf3015495ef6566c55c68b89abc78fd8a1ef4ca6cf0c98f089a"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x6ebcaa77e76cb250, r4, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="6300000043000000090000002dae6e22daab14ef9d497208a8517d45bc01cc145ce5aaf87060e525305035697ed88e7f161a0bc4d7c9c0f6529d18c1804edb8f99ba79960d502a0080223a8feabe12a06a5879a7b11d567242945cf3feae3f43d5"]) (async) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) 10:01:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) r3 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r3, 0x1, 0x24, 0x0, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x19) 10:01:54 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64=r1, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC=r1, @ANYRES64=r1, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT=r1], 0x16) 10:01:54 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000080), 0xffff, 0x400c40) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f00000000c0)) 10:01:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_SG_TABLESIZE(0xffffffffffffffff, 0x227f, &(0x7f0000000080)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) 10:01:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) syz_io_uring_complete(r1) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r3 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r3, 0x0, 0x481, 0x0, 0x0) setsockopt$sock_void(r3, 0x1, 0x24, 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000080)=0x19) 10:01:54 executing program 5: r0 = syz_io_uring_complete(0x0) write$P9_RRENAME(r0, &(0x7f0000000080)={0x7, 0x15, 0x1}, 0x7) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) socket$pppoe(0x18, 0x1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) getsockopt$SO_J1939_PROMISC(r2, 0x6b, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x4) 10:01:54 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64=r1, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC=r1, @ANYRES64=r1, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT=r1], 0x16) 10:01:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000340)={0x0, 0xfffffffffffffffc, 0xed, 0x0, @buffer={0x0, 0x56, &(0x7f0000000080)=""/86}, &(0x7f0000000100)="f399cdfb2338f5f3f3af9521b842bdb7a13e285c8edd79f7a74fb290eaae582825db6aa73820e88c276d5c58ed65d4f396cc47ec590c38a3e39ba806fd6cf4f968eebe6b380dd9f399073ef42ca845262f65ec08e1c9afdff6a4be6b66f524e078423849ed4684383e30b1dc7b8f342a32e5f99230ab02fd01b12ae03d1ef7e02588ac543cf19cf777beb4ef9492319afb26131e1ebfb243ce3681eca910b6eb100871e7ea99a3ea4bad9fc9c2f682048a97e3b800664e2e1c9dfce779322626a60a6008c2e49c54938c27e9300a4b2fe723250d3e4fa25bc7992f2d65dc65626f65d99072718033a05d0c6356", &(0x7f0000000200)=""/246, 0x6, 0x10010, 0x0, &(0x7f0000000300)}) 10:01:54 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = syz_open_dev$sg(&(0x7f0000000080), 0xffff, 0x400c40) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f00000000c0)) 10:01:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310020000008004100727865001400330076657468305f746f5f7465e16d0000000900020073797a32000000000800410073697700140033006e657470631213b302c999bf55605fd216b9c869300000000000000000000900020073797a30000000006d6163766c616e3000000000000000000900020073797a3100000072786500140033006970766c616e3000dfffffffffff10000900020073797a0e224571000800410073697700140033000000000073797a30000000000800410072786500140033007665322b5de96e40cdb2ebbc80c276ed8d999772f0e59f60973b819782578f6429af1754d04813095d10d05207b119fb2a43fd5c46c208000000687d6afc3998124f430f53eb1407d00e934aff4641f60900d17fc65d3edcc95b82c6b10df23b5bbec3595b19c47de02da1ae760d6e98c49902054536616d13a7892aa2c82a08e4c7a9fcb1dd87afc011fd110d61249584712be804429ad6090000000000000000000078bdaadbf68e918f71a29a43a6eda85c03e856e3ae6b422f3dbbca33b9396138ede18bf1d974697d0ba7f043eabdd487aee1551b767eb2419ef4eb8836d6d1b4d06f83bd99956811f94d9fc8bedb866aac78543c53f36c33063afa0b615b0f61c97eb811df482d3601024ee3405c79892a399510eb9ff097f3f7a7cc79e5474f90b36b3adaa051f8d93d9b4a6c586a401567b3c92a7557a703cccde2fd11bc21f06e31abc4a812d0b88510392b2b0c94f8e72a439402e1b5240725ecc691925bdaba126e023a6daaaba23fd5a294cd84afd51c17ce68ef5c9f2bb135f2"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x5460, 0x0) r4 = syz_io_uring_complete(0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6tnl0\x00', r6, 0x4, 0x20, 0x40, 0x8, 0x17, @private0, @dev={0xfe, 0x80, '\x00', 0xb}, 0x7, 0x8, 0x8001, 0x2}}) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) socket$can_j1939(0x1d, 0x2, 0x7) 10:01:54 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (rerun: 64) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:54 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000340)={0x0, 0xfffffffffffffffc, 0xed, 0x0, @buffer={0x0, 0x56, &(0x7f0000000080)=""/86}, &(0x7f0000000100)="f399cdfb2338f5f3f3af9521b842bdb7a13e285c8edd79f7a74fb290eaae582825db6aa73820e88c276d5c58ed65d4f396cc47ec590c38a3e39ba806fd6cf4f968eebe6b380dd9f399073ef42ca845262f65ec08e1c9afdff6a4be6b66f524e078423849ed4684383e30b1dc7b8f342a32e5f99230ab02fd01b12ae03d1ef7e02588ac543cf19cf777beb4ef9492319afb26131e1ebfb243ce3681eca910b6eb100871e7ea99a3ea4bad9fc9c2f682048a97e3b800664e2e1c9dfce779322626a60a6008c2e49c54938c27e9300a4b2fe723250d3e4fa25bc7992f2d65dc65626f65d99072718033a05d0c6356", &(0x7f0000000200)=""/246, 0x6, 0x10010, 0x0, &(0x7f0000000300)}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000340)={0x0, 0xfffffffffffffffc, 0xed, 0x0, @buffer={0x0, 0x56, &(0x7f0000000080)=""/86}, &(0x7f0000000100)="f399cdfb2338f5f3f3af9521b842bdb7a13e285c8edd79f7a74fb290eaae582825db6aa73820e88c276d5c58ed65d4f396cc47ec590c38a3e39ba806fd6cf4f968eebe6b380dd9f399073ef42ca845262f65ec08e1c9afdff6a4be6b66f524e078423849ed4684383e30b1dc7b8f342a32e5f99230ab02fd01b12ae03d1ef7e02588ac543cf19cf777beb4ef9492319afb26131e1ebfb243ce3681eca910b6eb100871e7ea99a3ea4bad9fc9c2f682048a97e3b800664e2e1c9dfce779322626a60a6008c2e49c54938c27e9300a4b2fe723250d3e4fa25bc7992f2d65dc65626f65d99072718033a05d0c6356", &(0x7f0000000200)=""/246, 0x6, 0x10010, 0x0, &(0x7f0000000300)}) (async) 10:01:55 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_ROPEN(r0, &(0x7f0000000040)={0x18, 0x71, 0x2, {{0x80, 0x3, 0x2}, 0x71c7}}, 0x18) 10:01:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async, rerun: 32) r2 = syz_io_uring_complete(r1) (rerun: 32) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310020000008004100727865001400330076657468305f746f5f7465e16d0000000900020073797a32000000000800410073697700140033006e657470631213b302c999bf55605fd216b9c869300000000000000000000900020073797a30000000006d6163766c616e3000000000000000000900020073797a3100000072786500140033006970766c616e3000dfffffffffff10000900020073797a0e224571000800410073697700140033000000000073797a30000000000800410072786500140033007665322b5de96e40cdb2ebbc80c276ed8d999772f0e59f60973b819782578f6429af1754d04813095d10d05207b119fb2a43fd5c46c208000000687d6afc3998124f430f53eb1407d00e934aff4641f60900d17fc65d3edcc95b82c6b10df23b5bbec3595b19c47de02da1ae760d6e98c49902054536616d13a7892aa2c82a08e4c7a9fcb1dd87afc011fd110d61249584712be804429ad6090000000000000000000078bdaadbf68e918f71a29a43a6eda85c03e856e3ae6b422f3dbbca33b9396138ede18bf1d974697d0ba7f043eabdd487aee1551b767eb2419ef4eb8836d6d1b4d06f83bd99956811f94d9fc8bedb866aac78543c53f36c33063afa0b615b0f61c97eb811df482d3601024ee3405c79892a399510eb9ff097f3f7a7cc79e5474f90b36b3adaa051f8d93d9b4a6c586a401567b3c92a7557a703cccde2fd11bc21f06e31abc4a812d0b88510392b2b0c94f8e72a439402e1b5240725ecc691925bdaba126e023a6daaaba23fd5a294cd84afd51c17ce68ef5c9f2bb135f2"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async, rerun: 32) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async, rerun: 32) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) (rerun: 32) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x5460, 0x0) (async, rerun: 32) r4 = syz_io_uring_complete(0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6tnl0\x00', r6, 0x4, 0x20, 0x40, 0x8, 0x17, @private0, @dev={0xfe, 0x80, '\x00', 0xb}, 0x7, 0x8, 0x8001, 0x2}}) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) socket$can_j1939(0x1d, 0x2, 0x7) 10:01:55 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000080), 0xffff, 0x400c40) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f00000000c0)) 10:01:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000340)={0x0, 0xfffffffffffffffc, 0xed, 0x0, @buffer={0x0, 0x56, &(0x7f0000000080)=""/86}, &(0x7f0000000100)="f399cdfb2338f5f3f3af9521b842bdb7a13e285c8edd79f7a74fb290eaae582825db6aa73820e88c276d5c58ed65d4f396cc47ec590c38a3e39ba806fd6cf4f968eebe6b380dd9f399073ef42ca845262f65ec08e1c9afdff6a4be6b66f524e078423849ed4684383e30b1dc7b8f342a32e5f99230ab02fd01b12ae03d1ef7e02588ac543cf19cf777beb4ef9492319afb26131e1ebfb243ce3681eca910b6eb100871e7ea99a3ea4bad9fc9c2f682048a97e3b800664e2e1c9dfce779322626a60a6008c2e49c54938c27e9300a4b2fe723250d3e4fa25bc7992f2d65dc65626f65d99072718033a05d0c6356", &(0x7f0000000200)=""/246, 0x6, 0x10010, 0x0, &(0x7f0000000300)}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000340)={0x0, 0xfffffffffffffffc, 0xed, 0x0, @buffer={0x0, 0x56, &(0x7f0000000080)=""/86}, &(0x7f0000000100)="f399cdfb2338f5f3f3af9521b842bdb7a13e285c8edd79f7a74fb290eaae582825db6aa73820e88c276d5c58ed65d4f396cc47ec590c38a3e39ba806fd6cf4f968eebe6b380dd9f399073ef42ca845262f65ec08e1c9afdff6a4be6b66f524e078423849ed4684383e30b1dc7b8f342a32e5f99230ab02fd01b12ae03d1ef7e02588ac543cf19cf777beb4ef9492319afb26131e1ebfb243ce3681eca910b6eb100871e7ea99a3ea4bad9fc9c2f682048a97e3b800664e2e1c9dfce779322626a60a6008c2e49c54938c27e9300a4b2fe723250d3e4fa25bc7992f2d65dc65626f65d99072718033a05d0c6356", &(0x7f0000000200)=""/246, 0x6, 0x10010, 0x0, &(0x7f0000000300)}) (async) 10:01:55 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = socket$pptp(0x18, 0x1, 0x2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64=r1, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC=r1, @ANYRES64=r1, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT=r1], 0x16) 10:01:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x8, 0x400000) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) r2 = socket$vsock_stream(0x28, 0x1, 0x0) accept4$vsock_stream(r2, &(0x7f00000000c0)={0x28, 0x0, 0xffffffff}, 0x10, 0x80800) 10:01:55 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020063797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r2) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, r4, 0x200, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4040080}, 0x84) r5 = accept4$llc(r2, 0x0, &(0x7f0000000600), 0x800) getsockopt$llc_int(r5, 0x10c, 0x4, &(0x7f0000000640), &(0x7f0000000680)=0x4) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000004c0), 0x8) syz_io_uring_setup(0x5a0b, &(0x7f0000000500)={0x0, 0x5d60, 0x4, 0x3, 0x8e, 0x0, r6}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000580), &(0x7f00000005c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)=@x25, 0x80, &(0x7f0000000880)=[{&(0x7f0000000740)="22bed3818e9a3b396d0919d279d63db9ab8af1d178c9198af2787ead4e73eeba0d630f2db59563a2918206ac49466e8539cb34da35edbe4620b8563e3aa21ac5b7fdadbf01e7f508cefe2a", 0x4b}, {&(0x7f00000007c0)}, {&(0x7f0000000800)="c3f8a9322a6faa487794c08bbfda8f9942936524cc39f1141427183dadfc7db28bdae9d4e0445c82d82d13d255118be68fc229d8d9e9baaa351142c270cc89", 0x3f}, {&(0x7f0000000840)="98d3659126dec0c17deae1e7d8642e0d02add2e7670eaace0a42ce28945f7568b99ba4fd93b269bfb28bf0", 0x2b}], 0x4}, 0x900) 10:01:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x8, 0x400000) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) r2 = socket$vsock_stream(0x28, 0x1, 0x0) accept4$vsock_stream(r2, &(0x7f00000000c0)={0x28, 0x0, 0xffffffff}, 0x10, 0x80800) 10:01:55 executing program 5: ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000000080)) r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) r1 = getuid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0xee01}, 0xc) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) accept4$llc(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x1267, &(0x7f0000000000)) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4}, 0x18) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={0x1d, r4, 0x1, {0x2, 0x0, 0x2}, 0x2}, 0x18) 10:01:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310020000008004100727865001400330076657468305f746f5f7465e16d0000000900020073797a32000000000800410073697700140033006e657470631213b302c999bf55605fd216b9c869300000000000000000000900020073797a30000000006d6163766c616e3000000000000000000900020073797a3100000072786500140033006970766c616e3000dfffffffffff10000900020073797a0e224571000800410073697700140033000000000073797a30000000000800410072786500140033007665322b5de96e40cdb2ebbc80c276ed8d999772f0e59f60973b819782578f6429af1754d04813095d10d05207b119fb2a43fd5c46c208000000687d6afc3998124f430f53eb1407d00e934aff4641f60900d17fc65d3edcc95b82c6b10df23b5bbec3595b19c47de02da1ae760d6e98c49902054536616d13a7892aa2c82a08e4c7a9fcb1dd87afc011fd110d61249584712be804429ad6090000000000000000000078bdaadbf68e918f71a29a43a6eda85c03e856e3ae6b422f3dbbca33b9396138ede18bf1d974697d0ba7f043eabdd487aee1551b767eb2419ef4eb8836d6d1b4d06f83bd99956811f94d9fc8bedb866aac78543c53f36c33063afa0b615b0f61c97eb811df482d3601024ee3405c79892a399510eb9ff097f3f7a7cc79e5474f90b36b3adaa051f8d93d9b4a6c586a401567b3c92a7557a703cccde2fd11bc21f06e31abc4a812d0b88510392b2b0c94f8e72a439402e1b5240725ecc691925bdaba126e023a6daaaba23fd5a294cd84afd51c17ce68ef5c9f2bb135f2"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x5460, 0x0) (async) r4 = syz_io_uring_complete(0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) (async, rerun: 64) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6tnl0\x00', r6, 0x4, 0x20, 0x40, 0x8, 0x17, @private0, @dev={0xfe, 0x80, '\x00', 0xb}, 0x7, 0x8, 0x8001, 0x2}}) (async) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) socket$can_j1939(0x1d, 0x2, 0x7) 10:01:55 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020063797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r2) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, r4, 0x200, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4040080}, 0x84) r5 = accept4$llc(r2, 0x0, &(0x7f0000000600), 0x800) getsockopt$llc_int(r5, 0x10c, 0x4, &(0x7f0000000640), &(0x7f0000000680)=0x4) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000004c0), 0x8) syz_io_uring_setup(0x5a0b, &(0x7f0000000500)={0x0, 0x5d60, 0x4, 0x3, 0x8e, 0x0, r6}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000580), &(0x7f00000005c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)=@x25, 0x80, &(0x7f0000000880)=[{&(0x7f0000000740)="22bed3818e9a3b396d0919d279d63db9ab8af1d178c9198af2787ead4e73eeba0d630f2db59563a2918206ac49466e8539cb34da35edbe4620b8563e3aa21ac5b7fdadbf01e7f508cefe2a", 0x4b}, {&(0x7f00000007c0)}, {&(0x7f0000000800)="c3f8a9322a6faa487794c08bbfda8f9942936524cc39f1141427183dadfc7db28bdae9d4e0445c82d82d13d255118be68fc229d8d9e9baaa351142c270cc89", 0x3f}, {&(0x7f0000000840)="98d3659126dec0c17deae1e7d8642e0d02add2e7670eaace0a42ce28945f7568b99ba4fd93b269bfb28bf0", 0x2b}], 0x4}, 0x900) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020063797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r2) (async) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, r4, 0x200, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4040080}, 0x84) (async) accept4$llc(r2, 0x0, &(0x7f0000000600), 0x800) (async) getsockopt$llc_int(r5, 0x10c, 0x4, &(0x7f0000000640), &(0x7f0000000680)=0x4) (async) bpf$ITER_CREATE(0x21, &(0x7f00000004c0), 0x8) (async) syz_io_uring_setup(0x5a0b, &(0x7f0000000500)={0x0, 0x5d60, 0x4, 0x3, 0x8e, 0x0, r6}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000580), &(0x7f00000005c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)=@x25, 0x80, &(0x7f0000000880)=[{&(0x7f0000000740)="22bed3818e9a3b396d0919d279d63db9ab8af1d178c9198af2787ead4e73eeba0d630f2db59563a2918206ac49466e8539cb34da35edbe4620b8563e3aa21ac5b7fdadbf01e7f508cefe2a", 0x4b}, {&(0x7f00000007c0)}, {&(0x7f0000000800)="c3f8a9322a6faa487794c08bbfda8f9942936524cc39f1141427183dadfc7db28bdae9d4e0445c82d82d13d255118be68fc229d8d9e9baaa351142c270cc89", 0x3f}, {&(0x7f0000000840)="98d3659126dec0c17deae1e7d8642e0d02add2e7670eaace0a42ce28945f7568b99ba4fd93b269bfb28bf0", 0x2b}], 0x4}, 0x900) (async) 10:01:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x8, 0x400000) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async, rerun: 32) r2 = socket$vsock_stream(0x28, 0x1, 0x0) (rerun: 32) accept4$vsock_stream(r2, &(0x7f00000000c0)={0x28, 0x0, 0xffffffff}, 0x10, 0x80800) 10:01:55 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) write$P9_ROPEN(r0, &(0x7f0000000040)={0x18, 0x71, 0x2, {{0x80, 0x3, 0x2}, 0x71c7}}, 0x18) 10:01:55 executing program 5: ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000000080)) r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) r1 = getuid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0xee01}, 0xc) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) accept4$llc(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x1267, &(0x7f0000000000)) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4}, 0x18) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={0x1d, r4, 0x1, {0x2, 0x0, 0x2}, 0x2}, 0x18) ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000000080)) (async) socket$pptp(0x18, 0x1, 0x2) (async) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) (async) getuid() (async) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0xee01}, 0xc) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) accept4$llc(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x1267, &(0x7f0000000000)) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4}, 0x18) (async) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={0x1d, r4, 0x1, {0x2, 0x0, 0x2}, 0x2}, 0x18) (async) 10:01:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="a03f4a639ea510cd83806e8e0d0bf128010000e444180f2cbd7000fedbdf250900020073797a31000000000800200073697700140033a1b5544668315f546f5f627269646765000900020073797ad87e00000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a320000000008004100736d7700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e0100000000000000000900020073797a31000000000800410072786500140033006970766c61be54372b00000000000000090002c473797a32003300000000000000000000000000000000000900020073797a300000000008004100650014003300760000e2491fbcde8811061f20a23ea5b66776bb1726764ab711ae09b76c31d25b8d28d4edb51bc60ca293f235aa414f68b56fb43050b3eb610c3795c4d76f17badf3e8eb3a6ab5547c6d5a72fc0d405f598a19b5ee99d450d8be9793787d8412443b0760d59747d626483cf6cf7599eb0ed1ca2886ae35287c74fc49ac1b0323eb1425d3893810a51395acc814cd1f9c84598481edf3a5e32a8c6e16fbf164fb49941ba6b023fb93342e98b475c561118fbbc36b692cff9bc902bdf153ba4fc7a8700000000000000000000005fbe2d44b884a34a326935c52d75ed2a428c22ab58ee4baac324af02bd7c1c80772421243b84226f481bc3ce807a879947c08165ffed35652ac907ccc4da0b686f3084"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000200)={r3}) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000080)) connect$nfc_raw(0xffffffffffffffff, &(0x7f00000001c0)={0x27, 0x1, 0x1, 0x4}, 0x10) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)={0xdb, 0x4, 0xfffffc00, "070faeb510a3d0735d4c0bea51f529aced640993415a667ad2ca1f56549509fa6afc2266e57762d453f145883504ef9455ba79b092777502136b8866d2535464c0368c1c2de77740fa247a29b473335fad9070eb0b26c02ff9ba59f27e07813c4eed1db13bf33be96292371a9dffffced83b81e0dd5a863881b662d2302d53c81f8eefd1a6175b0ea5d6f4b161edb5a91675ba42c45890689fe7e7b77a77b1e03e89e817dc813229bc01b320fd29a715d17c085e060ce2b003574538246018c312be7823561ae914354087e63fc2905a12ed34dca4ed7f8a69d909"}) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:55 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020063797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r2) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, r4, 0x200, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4040080}, 0x84) r5 = accept4$llc(r2, 0x0, &(0x7f0000000600), 0x800) getsockopt$llc_int(r5, 0x10c, 0x4, &(0x7f0000000640), &(0x7f0000000680)=0x4) r6 = bpf$ITER_CREATE(0x21, &(0x7f00000004c0), 0x8) syz_io_uring_setup(0x5a0b, &(0x7f0000000500)={0x0, 0x5d60, 0x4, 0x3, 0x8e, 0x0, r6}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000580), &(0x7f00000005c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000006c0)=@x25, 0x80, &(0x7f0000000880)=[{&(0x7f0000000740)="22bed3818e9a3b396d0919d279d63db9ab8af1d178c9198af2787ead4e73eeba0d630f2db59563a2918206ac49466e8539cb34da35edbe4620b8563e3aa21ac5b7fdadbf01e7f508cefe2a", 0x4b}, {&(0x7f00000007c0)}, {&(0x7f0000000800)="c3f8a9322a6faa487794c08bbfda8f9942936524cc39f1141427183dadfc7db28bdae9d4e0445c82d82d13d255118be68fc229d8d9e9baaa351142c270cc89", 0x3f}, {&(0x7f0000000840)="98d3659126dec0c17deae1e7d8642e0d02add2e7670eaace0a42ce28945f7568b99ba4fd93b269bfb28bf0", 0x2b}], 0x4}, 0x900) 10:01:55 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = socket$pptp(0x18, 0x1, 0x2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64=r1, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC=r1, @ANYRES64=r1, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT=r1], 0x16) 10:01:55 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) rt_sigaction(0x29, &(0x7f0000000480)={&(0x7f0000000400)="8f0978831dfeeffffff26564f00fc749d7c4633d48d004d9f18f89c899f7410f1f00c40279224900c4c2350cfcc441e1d262008f29e0939d00000000", 0x8000000, &(0x7f0000000440)="c48201458501000000362665470fd99a0e000000c402cd3f1bc4c2c99dbe97000000c402959610de3f0f1d233e400f00600065f3460fa7e8656466430f3810c0", {[0x1]}}, &(0x7f0000000580)={&(0x7f00000004c0)="36ff6cd902c442113b7100c4015175456f8f2978c1b7ffeffffff3430f2ba7944ac1dfc422f53c6605460f850a00000065662e432843ec1084e09834dbdc2643813ea5000000", 0x0, &(0x7f0000000540)="c4e3655c5547c32e410f9078006666460f1583f4ffffffc463714c36c12e0f6ac5c482f93096feeffffff2410f2c512446dbe48fa96892530af33ed0eb"}, 0x8, &(0x7f00000005c0)) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x8, 0x20000) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x9, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a3100000000080041007369770014726964676500090002007379727865001400330076657468305f7408000000000000000009000200737a32000000000800410073697700140033006e6574706369300000000000000000000073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300c00000008431a7b2da3b385f36c7cfa12046b004100727865001400330076657468315f766972745f776966690000"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x100000a, 0x1010, r4, 0x10000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000640)) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000600)) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000000)=0xfffffffb, 0x4) 10:01:55 executing program 5: ioctl$IMGETVERSION(0xffffffffffffffff, 0x80044942, &(0x7f0000000080)) (async) r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) (async) r1 = getuid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0xee01}, 0xc) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) accept4$llc(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x1267, &(0x7f0000000000)) (async) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4}, 0x18) (async) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={0x1d, r4, 0x1, {0x2, 0x0, 0x2}, 0x2}, 0x18) 10:01:55 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) rt_sigaction(0x29, &(0x7f0000000480)={&(0x7f0000000400)="8f0978831dfeeffffff26564f00fc749d7c4633d48d004d9f18f89c899f7410f1f00c40279224900c4c2350cfcc441e1d262008f29e0939d00000000", 0x8000000, &(0x7f0000000440)="c48201458501000000362665470fd99a0e000000c402cd3f1bc4c2c99dbe97000000c402959610de3f0f1d233e400f00600065f3460fa7e8656466430f3810c0", {[0x1]}}, &(0x7f0000000580)={&(0x7f00000004c0)="36ff6cd902c442113b7100c4015175456f8f2978c1b7ffeffffff3430f2ba7944ac1dfc422f53c6605460f850a00000065662e432843ec1084e09834dbdc2643813ea5000000", 0x0, &(0x7f0000000540)="c4e3655c5547c32e410f9078006666460f1583f4ffffffc463714c36c12e0f6ac5c482f93096feeffffff2410f2c512446dbe48fa96892530af33ed0eb"}, 0x8, &(0x7f00000005c0)) (async) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x8, 0x20000) (async) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x9, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a3100000000080041007369770014726964676500090002007379727865001400330076657468305f7408000000000000000009000200737a32000000000800410073697700140033006e6574706369300000000000000000000073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300c00000008431a7b2da3b385f36c7cfa12046b004100727865001400330076657468315f766972745f776966690000"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x100000a, 0x1010, r4, 0x10000000) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 64) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000640)) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000600)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) (async) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000000)=0xfffffffb, 0x4) 10:01:55 executing program 5: gettid() select(0x40, &(0x7f0000000080)={0x6, 0x2, 0x7fff, 0x41ddd8a3, 0x2, 0x8001, 0x2, 0x3ff}, &(0x7f00000000c0)={0x40, 0xc0, 0x4, 0x800, 0x8001, 0x9, 0x7, 0xc6}, &(0x7f0000000100)={0x3, 0x6, 0xde, 0x8000000000000000, 0x8, 0x8, 0xaf, 0x2}, &(0x7f0000000140)) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000180), 0x6, 0x40000) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000001c0)) 10:01:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="a03f4a639ea510cd83806e8e0d0bf128010000e444180f2cbd7000fedbdf250900020073797a31000000000800200073697700140033a1b5544668315f546f5f627269646765000900020073797ad87e00000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a320000000008004100736d7700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e0100000000000000000900020073797a31000000000800410072786500140033006970766c61be54372b00000000000000090002c473797a32003300000000000000000000000000000000000900020073797a300000000008004100650014003300760000e2491fbcde8811061f20a23ea5b66776bb1726764ab711ae09b76c31d25b8d28d4edb51bc60ca293f235aa414f68b56fb43050b3eb610c3795c4d76f17badf3e8eb3a6ab5547c6d5a72fc0d405f598a19b5ee99d450d8be9793787d8412443b0760d59747d626483cf6cf7599eb0ed1ca2886ae35287c74fc49ac1b0323eb1425d3893810a51395acc814cd1f9c84598481edf3a5e32a8c6e16fbf164fb49941ba6b023fb93342e98b475c561118fbbc36b692cff9bc902bdf153ba4fc7a8700000000000000000000005fbe2d44b884a34a326935c52d75ed2a428c22ab58ee4baac324af02bd7c1c80772421243b84226f481bc3ce807a879947c08165ffed35652ac907ccc4da0b686f3084"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000200)={r3}) (async) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000080)) (async) connect$nfc_raw(0xffffffffffffffff, &(0x7f00000001c0)={0x27, 0x1, 0x1, 0x4}, 0x10) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)={0xdb, 0x4, 0xfffffc00, "070faeb510a3d0735d4c0bea51f529aced640993415a667ad2ca1f56549509fa6afc2266e57762d453f145883504ef9455ba79b092777502136b8866d2535464c0368c1c2de77740fa247a29b473335fad9070eb0b26c02ff9ba59f27e07813c4eed1db13bf33be96292371a9dffffced83b81e0dd5a863881b662d2302d53c81f8eefd1a6175b0ea5d6f4b161edb5a91675ba42c45890689fe7e7b77a77b1e03e89e817dc813229bc01b320fd29a715d17c085e060ce2b003574538246018c312be7823561ae914354087e63fc2905a12ed34dca4ed7f8a69d909"}) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:55 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) 10:01:55 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) [ 3392.374007][T31549] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 10:01:55 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async, rerun: 32) write$P9_ROPEN(r0, &(0x7f0000000040)={0x18, 0x71, 0x2, {{0x80, 0x3, 0x2}, 0x71c7}}, 0x18) (rerun: 32) 10:01:55 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) rt_sigaction(0x29, &(0x7f0000000480)={&(0x7f0000000400)="8f0978831dfeeffffff26564f00fc749d7c4633d48d004d9f18f89c899f7410f1f00c40279224900c4c2350cfcc441e1d262008f29e0939d00000000", 0x8000000, &(0x7f0000000440)="c48201458501000000362665470fd99a0e000000c402cd3f1bc4c2c99dbe97000000c402959610de3f0f1d233e400f00600065f3460fa7e8656466430f3810c0", {[0x1]}}, &(0x7f0000000580)={&(0x7f00000004c0)="36ff6cd902c442113b7100c4015175456f8f2978c1b7ffeffffff3430f2ba7944ac1dfc422f53c6605460f850a00000065662e432843ec1084e09834dbdc2643813ea5000000", 0x0, &(0x7f0000000540)="c4e3655c5547c32e410f9078006666460f1583f4ffffffc463714c36c12e0f6ac5c482f93096feeffffff2410f2c512446dbe48fa96892530af33ed0eb"}, 0x8, &(0x7f00000005c0)) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x8, 0x20000) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x9, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) r4 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a3100000000080041007369770014726964676500090002007379727865001400330076657468305f7408000000000000000009000200737a32000000000800410073697700140033006e6574706369300000000000000000000073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300c00000008431a7b2da3b385f36c7cfa12046b004100727865001400330076657468315f766972745f776966690000"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x100000a, 0x1010, r4, 0x10000000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000640)) (async) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000600)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f00000000c0)) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x66, &(0x7f0000000000)=0xfffffffb, 0x4) 10:01:55 executing program 5: gettid() (async, rerun: 32) select(0x40, &(0x7f0000000080)={0x6, 0x2, 0x7fff, 0x41ddd8a3, 0x2, 0x8001, 0x2, 0x3ff}, &(0x7f00000000c0)={0x40, 0xc0, 0x4, 0x800, 0x8001, 0x9, 0x7, 0xc6}, &(0x7f0000000100)={0x3, 0x6, 0xde, 0x8000000000000000, 0x8, 0x8, 0xaf, 0x2}, &(0x7f0000000140)) (rerun: 32) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000180), 0x6, 0x40000) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000001c0)) 10:01:55 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) 10:01:55 executing program 5: gettid() (async) select(0x40, &(0x7f0000000080)={0x6, 0x2, 0x7fff, 0x41ddd8a3, 0x2, 0x8001, 0x2, 0x3ff}, &(0x7f00000000c0)={0x40, 0xc0, 0x4, 0x800, 0x8001, 0x9, 0x7, 0xc6}, &(0x7f0000000100)={0x3, 0x6, 0xde, 0x8000000000000000, 0x8, 0x8, 0xaf, 0x2}, &(0x7f0000000140)) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000180), 0x6, 0x40000) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f00000001c0)) 10:01:55 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:55 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x12000, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000140)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000000c0)=0xe9) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 10:01:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="a03f4a639ea510cd83806e8e0d0bf128010000e444180f2cbd7000fedbdf250900020073797a31000000000800200073697700140033a1b5544668315f546f5f627269646765000900020073797ad87e00000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a320000000008004100736d7700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e0100000000000000000900020073797a31000000000800410072786500140033006970766c61be54372b00000000000000090002c473797a32003300000000000000000000000000000000000900020073797a300000000008004100650014003300760000e2491fbcde8811061f20a23ea5b66776bb1726764ab711ae09b76c31d25b8d28d4edb51bc60ca293f235aa414f68b56fb43050b3eb610c3795c4d76f17badf3e8eb3a6ab5547c6d5a72fc0d405f598a19b5ee99d450d8be9793787d8412443b0760d59747d626483cf6cf7599eb0ed1ca2886ae35287c74fc49ac1b0323eb1425d3893810a51395acc814cd1f9c84598481edf3a5e32a8c6e16fbf164fb49941ba6b023fb93342e98b475c561118fbbc36b692cff9bc902bdf153ba4fc7a8700000000000000000000005fbe2d44b884a34a326935c52d75ed2a428c22ab58ee4baac324af02bd7c1c80772421243b84226f481bc3ce807a879947c08165ffed35652ac907ccc4da0b686f3084"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000200)={r3}) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000080)) connect$nfc_raw(0xffffffffffffffff, &(0x7f00000001c0)={0x27, 0x1, 0x1, 0x4}, 0x10) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)={0xdb, 0x4, 0xfffffc00, "070faeb510a3d0735d4c0bea51f529aced640993415a667ad2ca1f56549509fa6afc2266e57762d453f145883504ef9455ba79b092777502136b8866d2535464c0368c1c2de77740fa247a29b473335fad9070eb0b26c02ff9ba59f27e07813c4eed1db13bf33be96292371a9dffffced83b81e0dd5a863881b662d2302d53c81f8eefd1a6175b0ea5d6f4b161edb5a91675ba42c45890689fe7e7b77a77b1e03e89e817dc813229bc01b320fd29a715d17c085e060ce2b003574538246018c312be7823561ae914354087e63fc2905a12ed34dca4ed7f8a69d909"}) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="a03f4a639ea510cd83806e8e0d0bf128010000e444180f2cbd7000fedbdf250900020073797a31000000000800200073697700140033a1b5544668315f546f5f627269646765000900020073797ad87e00000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a320000000008004100736d7700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e0100000000000000000900020073797a31000000000800410072786500140033006970766c61be54372b00000000000000090002c473797a32003300000000000000000000000000000000000900020073797a300000000008004100650014003300760000e2491fbcde8811061f20a23ea5b66776bb1726764ab711ae09b76c31d25b8d28d4edb51bc60ca293f235aa414f68b56fb43050b3eb610c3795c4d76f17badf3e8eb3a6ab5547c6d5a72fc0d405f598a19b5ee99d450d8be9793787d8412443b0760d59747d626483cf6cf7599eb0ed1ca2886ae35287c74fc49ac1b0323eb1425d3893810a51395acc814cd1f9c84598481edf3a5e32a8c6e16fbf164fb49941ba6b023fb93342e98b475c561118fbbc36b692cff9bc902bdf153ba4fc7a8700000000000000000000005fbe2d44b884a34a326935c52d75ed2a428c22ab58ee4baac324af02bd7c1c80772421243b84226f481bc3ce807a879947c08165ffed35652ac907ccc4da0b686f3084"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) socket$inet6(0xa, 0x3, 0x0) (async) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000200)={r3}) (async) ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000080)) (async) connect$nfc_raw(0xffffffffffffffff, &(0x7f00000001c0)={0x27, 0x1, 0x1, 0x4}, 0x10) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)={0xdb, 0x4, 0xfffffc00, "070faeb510a3d0735d4c0bea51f529aced640993415a667ad2ca1f56549509fa6afc2266e57762d453f145883504ef9455ba79b092777502136b8866d2535464c0368c1c2de77740fa247a29b473335fad9070eb0b26c02ff9ba59f27e07813c4eed1db13bf33be96292371a9dffffced83b81e0dd5a863881b662d2302d53c81f8eefd1a6175b0ea5d6f4b161edb5a91675ba42c45890689fe7e7b77a77b1e03e89e817dc813229bc01b320fd29a715d17c085e060ce2b003574538246018c312be7823561ae914354087e63fc2905a12ed34dca4ed7f8a69d909"}) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) 10:01:55 executing program 0: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) syz_io_uring_complete(r0) syz_io_uring_complete(r0) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2203, &(0x7f0000000000)) 10:01:55 executing program 0: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) syz_io_uring_complete(r0) syz_io_uring_complete(r0) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2203, &(0x7f0000000000)) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_complete(r0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2203, &(0x7f0000000000)) (async) 10:01:55 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x12000, 0x0) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000140)) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000000c0)=0xe9) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 10:01:55 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000002e0000082abd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="ebffe0ff15da9270df7e602090d29f4d1c621c5902004c3152ea0d0008000d0009000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0xc00c090) [ 3392.670031][T31623] program syz-executor.1 is using a deprecated SCSI ioctl, please convert it to SG_IO 10:01:56 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3d}}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_TID={0xc, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008040}, 0x40054) syz_io_uring_complete(r3) 10:01:56 executing program 0: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) syz_io_uring_complete(r0) (async) syz_io_uring_complete(r0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x12000, 0x0) (rerun: 64) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000140)) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000000c0)=0xe9) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) io_uring_setup(0xf9a, &(0x7f0000000440)={0x0, 0xcbf, 0x0, 0x3, 0xf7, 0x0, r3}) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r6, 0x118, &(0x7f00000000c0)=0x1, 0x0, 0x4) ioctl$SG_NEXT_CMD_LEN(r5, 0x2283, &(0x7f0000000400)=0x84) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={0xffffffffffffffff, r2, 0x4, r5}, 0x10) 10:01:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000002e0000082abd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="ebffe0ff15da9270df7e602090d29f4d1c621c5902004c3152ea0d0008000d0009000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0xc00c090) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000002e0000082abd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="ebffe0ff15da9270df7e602090d29f4d1c621c5902004c3152ea0d0008000d0009000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0xc00c090) (async) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) io_uring_setup(0xf9a, &(0x7f0000000440)={0x0, 0xcbf, 0x0, 0x3, 0xf7, 0x0, r3}) (async) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r6, 0x118, &(0x7f00000000c0)=0x1, 0x0, 0x4) ioctl$SG_NEXT_CMD_LEN(r5, 0x2283, &(0x7f0000000400)=0x84) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={0xffffffffffffffff, r2, 0x4, r5}, 0x10) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000002e0000082abd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="ebffe0ff15da9270df7e602090d29f4d1c621c5902004c3152ea0d0008000d0009000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0xc00c090) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000002e0000082abd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="ebffe0ff15da9270df7e602090d29f4d1c621c5902004c3152ea0d0008000d0009000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0xc00c090) (async) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, &(0x7f0000000200)) bind$pptp(0xffffffffffffffff, &(0x7f0000000140)={0x18, 0x2, {0x3, @remote}}, 0x1e) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r3 = socket(0x10, 0x2, 0x6) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'ip6gre0\x00', r2, 0x70097832bcc49fc3, 0x1f, 0x8, 0x3, 0x0, @mcast1, @remote, 0x8, 0x10, 0x5, 0x80000002}}) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100327865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a3000000000080041007278650014ff320076657468215f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4, 0x0, {}, 0x3d42ee36d00ada1b}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x4, 0x4, 0x1, 0xffffffff, 0x22, @mcast2, @private0, 0x40, 0x10, 0x6, 0x8}}) r5 = syz_open_dev$sg(&(0x7f0000000380), 0xe4, 0x443) ioctl$SCSI_IOCTL_GET_IDLUN(r5, 0x5382, &(0x7f00000003c0)) syz_io_uring_setup(0x7f05, &(0x7f0000000180)={0x0, 0xbef3, 0x20, 0x1, 0x200000a6}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000240)=0x0) r7 = bpf$ITER_CREATE(0x21, &(0x7f0000000280), 0x8) syz_io_uring_submit(0x0, r6, &(0x7f0000000340)=@IORING_OP_OPENAT2={0x1c, 0x4, 0x0, r7, &(0x7f00000002c0)={0x20000, 0x40, 0xb}, &(0x7f0000000300)='./file0\x00', 0x18, 0x0, 0x23456}, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) sendmsg$GTP_CMD_GETPDP(r7, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000600)={&(0x7f00000008c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00012bbd7000fcdbdf250200000008000400ac1e00010c0003000300000000000000080009000300000008000400e000000206000600000000000c0003008a08aa46000000001400010006effdda5c5a30a31df78d094bdc7dcad13457baaa66951c0ee1c84b9383ca2a3f43351b952782789fcfab055a5b56d3e2683b6b", @ANYRESDEC=r0, @ANYBLOB="e14897db0a7ab1c6ce03ebff3d06709d36c80579b499bee830955013380155095d84eff2923cc6b7c378a52427ee761f6fbeefdd25ff623d691243ec665bf7df9b2087e1e6d6995787eb99164af8fc9abdfd29ca38b97fe17ebd2aac0d8114d70e9ef2c925dad3106fbe07a4c05342b5b4405da46e90b1c3d8198548f711b062d462e89b7c472376dbcbec5674d5b7e127033512e6e3416f034c24e6aacb694c93e644098126be8068f47e1db7a1cb61af22773f9e56bd9f7ad33914e21b977f9b1aae2b951ba3f799e7002c7247137825ee0e6f95692b54dd6fcfbaa0710bfb3f75ee8d988bdccf811f8a1b74ced5e5b47d87f22f9c4af37e622559a7c75544f57269e960f05c29b3f0d1783755424c9b4a5a0f7974cf9d81f3fe09129e9c4ef19350839eeb2d4a0a713a247aede856f2bbb7bce1a2ae9b727b8cc15b922921ed8d5d7e2f00187b1d55ff39de2c78436087a5ae6a9abda515a349752e24392ceb1788c980df4743565804b0fa244141cd59cb79176b2adbe69c22a8320e40987815ef8f2b"], 0x54}, 0x1, 0x0, 0x0, 0x48080}, 0x4000810) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) io_uring_setup(0xf9a, &(0x7f0000000440)={0x0, 0xcbf, 0x0, 0x3, 0xf7, 0x0, r3}) r5 = syz_io_uring_complete(r4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r6, 0x118, &(0x7f00000000c0)=0x1, 0x0, 0x4) ioctl$SG_NEXT_CMD_LEN(r5, 0x2283, &(0x7f0000000400)=0x84) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={0xffffffffffffffff, r2, 0x4, r5}, 0x10) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, 0x0, 0x0, 0x4) (async) io_uring_setup(0xf9a, &(0x7f0000000440)={0x0, 0xcbf, 0x0, 0x3, 0xf7, 0x0, r3}) (async) syz_io_uring_complete(r4) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r5}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r5, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r6, 0x118, &(0x7f00000000c0)=0x1, 0x0, 0x4) (async) ioctl$SG_NEXT_CMD_LEN(r5, 0x2283, &(0x7f0000000400)=0x84) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={0xffffffffffffffff, r2, 0x4, r5}, 0x10) (async) [ 3393.340949][ T25] audit: type=1400 audit(1654250516.336:296): avc: denied { ioctl } for pid=31661 comm="syz-executor.0" path="socket:[1802321]" dev="sockfs" ino=1802321 ioctlcmd=0x89f1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 3393.342454][ T25] audit: type=1400 audit(1654250516.336:297): avc: denied { bind } for pid=31661 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 10:01:56 executing program 2: write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, &(0x7f0000000200)) bind$pptp(0xffffffffffffffff, &(0x7f0000000140)={0x18, 0x2, {0x3, @remote}}, 0x1e) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r3 = socket(0x10, 0x2, 0x6) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'ip6gre0\x00', r2, 0x70097832bcc49fc3, 0x1f, 0x8, 0x3, 0x0, @mcast1, @remote, 0x8, 0x10, 0x5, 0x80000002}}) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100327865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a3000000000080041007278650014ff320076657468215f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4, 0x0, {}, 0x3d42ee36d00ada1b}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x4, 0x4, 0x1, 0xffffffff, 0x22, @mcast2, @private0, 0x40, 0x10, 0x6, 0x8}}) r5 = syz_open_dev$sg(&(0x7f0000000380), 0xe4, 0x443) ioctl$SCSI_IOCTL_GET_IDLUN(r5, 0x5382, &(0x7f00000003c0)) syz_io_uring_setup(0x7f05, &(0x7f0000000180)={0x0, 0xbef3, 0x20, 0x1, 0x200000a6}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000240)=0x0) r7 = bpf$ITER_CREATE(0x21, &(0x7f0000000280), 0x8) syz_io_uring_submit(0x0, r6, &(0x7f0000000340)=@IORING_OP_OPENAT2={0x1c, 0x4, 0x0, r7, &(0x7f00000002c0)={0x20000, 0x40, 0xb}, &(0x7f0000000300)='./file0\x00', 0x18, 0x0, 0x23456}, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) sendmsg$GTP_CMD_GETPDP(r7, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000600)={&(0x7f00000008c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00012bbd7000fcdbdf250200000008000400ac1e00010c0003000300000000000000080009000300000008000400e000000206000600000000000c0003008a08aa46000000001400010006effdda5c5a30a31df78d094bdc7dcad13457baaa66951c0ee1c84b9383ca2a3f43351b952782789fcfab055a5b56d3e2683b6b", @ANYRESDEC=r0, @ANYBLOB="e14897db0a7ab1c6ce03ebff3d06709d36c80579b499bee830955013380155095d84eff2923cc6b7c378a52427ee761f6fbeefdd25ff623d691243ec665bf7df9b2087e1e6d6995787eb99164af8fc9abdfd29ca38b97fe17ebd2aac0d8114d70e9ef2c925dad3106fbe07a4c05342b5b4405da46e90b1c3d8198548f711b062d462e89b7c472376dbcbec5674d5b7e127033512e6e3416f034c24e6aacb694c93e644098126be8068f47e1db7a1cb61af22773f9e56bd9f7ad33914e21b977f9b1aae2b951ba3f799e7002c7247137825ee0e6f95692b54dd6fcfbaa0710bfb3f75ee8d988bdccf811f8a1b74ced5e5b47d87f22f9c4af37e622559a7c75544f57269e960f05c29b3f0d1783755424c9b4a5a0f7974cf9d81f3fe09129e9c4ef19350839eeb2d4a0a713a247aede856f2bbb7bce1a2ae9b727b8cc15b922921ed8d5d7e2f00187b1d55ff39de2c78436087a5ae6a9abda515a349752e24392ceb1788c980df4743565804b0fa244141cd59cb79176b2adbe69c22a8320e40987815ef8f2b"], 0x54}, 0x1, 0x0, 0x0, 0x48080}, 0x4000810) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, &(0x7f0000000200)) (async) bind$pptp(0xffffffffffffffff, &(0x7f0000000140)={0x18, 0x2, {0x3, @remote}}, 0x1e) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) socket(0x10, 0x2, 0x6) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'ip6gre0\x00', r2, 0x70097832bcc49fc3, 0x1f, 0x8, 0x3, 0x0, @mcast1, @remote, 0x8, 0x10, 0x5, 0x80000002}}) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100327865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a3000000000080041007278650014ff320076657468215f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) (async) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4, 0x0, {}, 0x3d42ee36d00ada1b}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x4, 0x4, 0x1, 0xffffffff, 0x22, @mcast2, @private0, 0x40, 0x10, 0x6, 0x8}}) (async) syz_open_dev$sg(&(0x7f0000000380), 0xe4, 0x443) (async) ioctl$SCSI_IOCTL_GET_IDLUN(r5, 0x5382, &(0x7f00000003c0)) (async) syz_io_uring_setup(0x7f05, &(0x7f0000000180)={0x0, 0xbef3, 0x20, 0x1, 0x200000a6}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000240)) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000280), 0x8) (async) syz_io_uring_submit(0x0, r6, &(0x7f0000000340)=@IORING_OP_OPENAT2={0x1c, 0x4, 0x0, r7, &(0x7f00000002c0)={0x20000, 0x40, 0xb}, &(0x7f0000000300)='./file0\x00', 0x18, 0x0, 0x23456}, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) (async) sendmsg$GTP_CMD_GETPDP(r7, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000600)={&(0x7f00000008c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00012bbd7000fcdbdf250200000008000400ac1e00010c0003000300000000000000080009000300000008000400e000000206000600000000000c0003008a08aa46000000001400010006effdda5c5a30a31df78d094bdc7dcad13457baaa66951c0ee1c84b9383ca2a3f43351b952782789fcfab055a5b56d3e2683b6b", @ANYRESDEC=r0, @ANYBLOB="e14897db0a7ab1c6ce03ebff3d06709d36c80579b499bee830955013380155095d84eff2923cc6b7c378a52427ee761f6fbeefdd25ff623d691243ec665bf7df9b2087e1e6d6995787eb99164af8fc9abdfd29ca38b97fe17ebd2aac0d8114d70e9ef2c925dad3106fbe07a4c05342b5b4405da46e90b1c3d8198548f711b062d462e89b7c472376dbcbec5674d5b7e127033512e6e3416f034c24e6aacb694c93e644098126be8068f47e1db7a1cb61af22773f9e56bd9f7ad33914e21b977f9b1aae2b951ba3f799e7002c7247137825ee0e6f95692b54dd6fcfbaa0710bfb3f75ee8d988bdccf811f8a1b74ced5e5b47d87f22f9c4af37e622559a7c75544f57269e960f05c29b3f0d1783755424c9b4a5a0f7974cf9d81f3fe09129e9c4ef19350839eeb2d4a0a713a247aede856f2bbb7bce1a2ae9b727b8cc15b922921ed8d5d7e2f00187b1d55ff39de2c78436087a5ae6a9abda515a349752e24392ceb1788c980df4743565804b0fa244141cd59cb79176b2adbe69c22a8320e40987815ef8f2b"], 0x54}, 0x1, 0x0, 0x0, 0x48080}, 0x4000810) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x4, 0x2, 0x6, 0xffffffc1, 0xd, @ipv4={'\x00', '\xff\xff', @broadcast}, @private2, 0x700, 0x7800, 0x40, 0x1f}}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000900)={0xffffffffffffffff, 0xee00, 0xee01}, 0xc) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x4, 0x80, 0x8, 0x200, 0x2, @empty, @private0, 0x7800, 0x7800, 0x3, 0x8}}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) r6 = socket$inet6(0xa, 0x4, 0x3) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f00000008c0)={'syztnl2\x00', &(0x7f0000000840)={'sit0\x00', r8, 0x2f, 0x4, 0x6, 0x4, 0x48, @local, @mcast1, 0x8, 0x40, 0x8, 0x3}}) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r9, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000240)={0x554, 0x0, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [{{0x8, 0x1, r1}, {0x178, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4000000}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}]}}, {{0x8, 0x1, r4}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xc63f}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8, 0x1, r9}, {0x13c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x401, 0x8, 0xfe, 0x7}, {0x4, 0x5, 0xfd, 0x1000}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fff}}}]}}, {{0x8}, {0x16c, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}}]}}]}, 0x554}, 0x1, 0x0, 0x0, 0x20000004}, 0x400c000) 10:01:56 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3d}}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_TID={0xc, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008040}, 0x40054) (async) syz_io_uring_complete(r3) 10:01:56 executing program 5: syz_open_dev$sg(&(0x7f0000000240), 0x20004, 0x30b000) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f00000000c0)) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x20140) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000080)=0x6) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000040)=0x8) 10:01:56 executing program 5: syz_open_dev$sg(&(0x7f0000000240), 0x20004, 0x30b000) (async, rerun: 64) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f00000000c0)) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x20140) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000080)=0x6) (async) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000040)=0x8) 10:01:56 executing program 2: write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, &(0x7f0000000200)) (async) bind$pptp(0xffffffffffffffff, &(0x7f0000000140)={0x18, 0x2, {0x3, @remote}}, 0x1e) (async) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) (async) r3 = socket(0x10, 0x2, 0x6) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000480)={'ip6tnl0\x00', &(0x7f0000000400)={'ip6gre0\x00', r2, 0x70097832bcc49fc3, 0x1f, 0x8, 0x3, 0x0, @mcast1, @remote, 0x8, 0x10, 0x5, 0x80000002}}) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100327865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a3000000000080041007278650014ff320076657468215f766972745f7769666900"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) (async) ioctl$SCSI_IOCTL_DOORLOCK(0xffffffffffffffff, 0x5380) (async) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r4, 0x0, {}, 0x3d42ee36d00ada1b}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x4, 0x4, 0x1, 0xffffffff, 0x22, @mcast2, @private0, 0x40, 0x10, 0x6, 0x8}}) (async) r5 = syz_open_dev$sg(&(0x7f0000000380), 0xe4, 0x443) ioctl$SCSI_IOCTL_GET_IDLUN(r5, 0x5382, &(0x7f00000003c0)) syz_io_uring_setup(0x7f05, &(0x7f0000000180)={0x0, 0xbef3, 0x20, 0x1, 0x200000a6}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000004c0), &(0x7f0000000240)=0x0) (async) r7 = bpf$ITER_CREATE(0x21, &(0x7f0000000280), 0x8) syz_io_uring_submit(0x0, r6, &(0x7f0000000340)=@IORING_OP_OPENAT2={0x1c, 0x4, 0x0, r7, &(0x7f00000002c0)={0x20000, 0x40, 0xb}, &(0x7f0000000300)='./file0\x00', 0x18, 0x0, 0x23456}, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) sendmsg$GTP_CMD_GETPDP(r7, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000600)={&(0x7f00000008c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00012bbd7000fcdbdf250200000008000400ac1e00010c0003000300000000000000080009000300000008000400e000000206000600000000000c0003008a08aa46000000001400010006effdda5c5a30a31df78d094bdc7dcad13457baaa66951c0ee1c84b9383ca2a3f43351b952782789fcfab055a5b56d3e2683b6b", @ANYRESDEC=r0, @ANYBLOB="e14897db0a7ab1c6ce03ebff3d06709d36c80579b499bee830955013380155095d84eff2923cc6b7c378a52427ee761f6fbeefdd25ff623d691243ec665bf7df9b2087e1e6d6995787eb99164af8fc9abdfd29ca38b97fe17ebd2aac0d8114d70e9ef2c925dad3106fbe07a4c05342b5b4405da46e90b1c3d8198548f711b062d462e89b7c472376dbcbec5674d5b7e127033512e6e3416f034c24e6aacb694c93e644098126be8068f47e1db7a1cb61af22773f9e56bd9f7ad33914e21b977f9b1aae2b951ba3f799e7002c7247137825ee0e6f95692b54dd6fcfbaa0710bfb3f75ee8d988bdccf811f8a1b74ced5e5b47d87f22f9c4af37e622559a7c75544f57269e960f05c29b3f0d1783755424c9b4a5a0f7974cf9d81f3fe09129e9c4ef19350839eeb2d4a0a713a247aede856f2bbb7bce1a2ae9b727b8cc15b922921ed8d5d7e2f00187b1d55ff39de2c78436087a5ae6a9abda515a349752e24392ceb1788c980df4743565804b0fa244141cd59cb79176b2adbe69c22a8320e40987815ef8f2b"], 0x54}, 0x1, 0x0, 0x0, 0x48080}, 0x4000810) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x4, 0x2, 0x6, 0xffffffc1, 0xd, @ipv4={'\x00', '\xff\xff', @broadcast}, @private2, 0x700, 0x7800, 0x40, 0x1f}}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000900)={0xffffffffffffffff, 0xee00, 0xee01}, 0xc) (async) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x4, 0x80, 0x8, 0x200, 0x2, @empty, @private0, 0x7800, 0x7800, 0x3, 0x8}}) (async) r5 = socket$can_j1939(0x1d, 0x2, 0x7) (async) r6 = socket$inet6(0xa, 0x4, 0x3) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f00000008c0)={'syztnl2\x00', &(0x7f0000000840)={'sit0\x00', r8, 0x2f, 0x4, 0x6, 0x4, 0x48, @local, @mcast1, 0x8, 0x40, 0x8, 0x3}}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r9, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000240)={0x554, 0x0, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [{{0x8, 0x1, r1}, {0x178, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4000000}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}]}}, {{0x8, 0x1, r4}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xc63f}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8, 0x1, r9}, {0x13c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x401, 0x8, 0xfe, 0x7}, {0x4, 0x5, 0xfd, 0x1000}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fff}}}]}}, {{0x8}, {0x16c, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}}]}}]}, 0x554}, 0x1, 0x0, 0x0, 0x20000004}, 0x400c000) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x20140) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000080)=0x6) (async) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, &(0x7f0000000040)=0x8) 10:01:56 executing program 2: write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x101, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 1: syz_clone(0x3801f00, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xffffffffffff8001, 0x22000) ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:56 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180)=0x0, &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x3d}}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_TID={0xc, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008040}, 0x40054) syz_io_uring_complete(r3) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x4, 0x2, 0x6, 0xffffffc1, 0xd, @ipv4={'\x00', '\xff\xff', @broadcast}, @private2, 0x700, 0x7800, 0x40, 0x1f}}) (async) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) (async, rerun: 32) setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000900)={0xffffffffffffffff, 0xee00, 0xee01}, 0xc) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x4, 0x80, 0x8, 0x200, 0x2, @empty, @private0, 0x7800, 0x7800, 0x3, 0x8}}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) r6 = socket$inet6(0xa, 0x4, 0x3) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000040)={0x1d, r8}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f00000008c0)={'syztnl2\x00', &(0x7f0000000840)={'sit0\x00', r8, 0x2f, 0x4, 0x6, 0x4, 0x48, @local, @mcast1, 0x8, 0x40, 0x8, 0x3}}) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000080)=@raw=[@cb_func], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r9, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000240)={0x554, 0x0, 0x400, 0x70bd2d, 0x25dfdbfb, {}, [{{0x8, 0x1, r1}, {0x178, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4000000}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}]}}, {{0x8, 0x1, r4}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xc63f}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}]}}, {{0x8, 0x1, r9}, {0x13c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x401, 0x8, 0xfe, 0x7}, {0x4, 0x5, 0xfd, 0x1000}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fff}}}]}}, {{0x8}, {0x16c, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}}]}}]}, 0x554}, 0x1, 0x0, 0x0, 0x20000004}, 0x400c000) 10:01:56 executing program 5: syz_open_dev$sg(&(0x7f0000000240), 0x20004, 0x30b000) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f00000000c0)) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, 0x0, 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x101, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 1: syz_clone(0x3801f00, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xffffffffffff8001, 0x22000) ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f00000000c0)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x101, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, 0x0, 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000080)) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, 0x0, 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 1: syz_clone(0x3801f00, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000080), 0xffffffffffff8001, 0x22000) ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f00000000c0)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) syz_clone(0x3801f00, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0xffffffffffff8001, 0x22000) (async) ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f00000000c0)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, &(0x7f0000000040)) 10:01:56 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) write$P9_RLERRORu(r1, &(0x7f0000000100)={0x16, 0x7, 0x8001, {{0x2, '/dev/bsg\x00'}}}, 0x16) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000, 0x80902) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000080)) (async) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000, 0x80902) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, &(0x7f0000000040)) (async) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) write$P9_RLERRORu(r1, &(0x7f0000000100)={0x16, 0x7, 0x8001, {{0x2, '/dev/bsg\x00'}}}, 0x16) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0x82) 10:01:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000080)) (async) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, &(0x7f0000000040)) (async) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) write$P9_RLERRORu(r1, &(0x7f0000000100)={0x16, 0x7, 0x8001, {{0x2, '/dev/bsg\x00'}}}, 0x16) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RREADLINK(r0, &(0x7f0000000040)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) (async) bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) (async) write$P9_RLERRORu(r1, &(0x7f0000000100)={0x16, 0x7, 0x8001, {{0x2, '/dev/bsg\x00'}}}, 0x16) (async) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000, 0x80902) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0x82) 10:01:56 executing program 0: getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="6465762fff73670000000000"], 0x87ffff2) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0x82) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000080)=0x82) (async) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x305c41) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0xffffffff00000000, 0x80) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x305c41) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async, rerun: 32) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0xffffffff00000000, 0x80) (rerun: 32) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 10:01:56 executing program 0: getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) (async) 10:01:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) getegid() r1 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, &(0x7f0000000280)='wg2\x00', 0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x2010610, &(0x7f0000000180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@nodevmap}, {@access_uid={'access', 0x3d, 0xee00}}, {@access_user}, {@debug={'debug', 0x3d, 0x20}}, {@access_uid={'access', 0x3d, r2}}, {@noextend}, {@cache_fscache}, {@access_user}]}}) 10:01:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) getegid() r1 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, &(0x7f0000000280)='wg2\x00', 0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x2010610, &(0x7f0000000180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@nodevmap}, {@access_uid={'access', 0x3d, 0xee00}}, {@access_user}, {@debug={'debug', 0x3d, 0x20}}, {@access_uid={'access', 0x3d, r2}}, {@noextend}, {@cache_fscache}, {@access_user}]}}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) getegid() (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, &(0x7f0000000280)='wg2\x00', 0x4) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) (async) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x2010610, &(0x7f0000000180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@nodevmap}, {@access_uid={'access', 0x3d, 0xee00}}, {@access_user}, {@debug={'debug', 0x3d, 0x20}}, {@access_uid={'access', 0x3d, r2}}, {@noextend}, {@cache_fscache}, {@access_user}]}}) (async) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) 10:01:56 executing program 0: getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) 10:01:56 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x305c41) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0xffffffff00000000, 0x80) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 10:01:56 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="6465762fff73670000000000"], 0x87ffff2) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x54, 0x2) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) socket$inet6_mptcp(0xa, 0x1, 0x106) write$selinux_attr(0xffffffffffffffff, &(0x7f0000000040)='system_u:object_r:audisp_var_run_t:s0\x00', 0x26) r1 = socket$pptp(0x18, 0x1, 0x2) r2 = syz_open_dev$sg(&(0x7f0000000480), 0x5, 0x100) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f00000004c0)=0x1) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000000c0)=0x1) setsockopt$sock_void(r1, 0x1, 0x24, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000400)=""/3, &(0x7f0000000440)=0x3) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x2270, &(0x7f0000000000)) 10:01:56 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) getegid() r1 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, &(0x7f0000000280)='wg2\x00', 0x4) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x2010610, &(0x7f0000000180)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@nodevmap}, {@access_uid={'access', 0x3d, 0xee00}}, {@access_user}, {@debug={'debug', 0x3d, 0x20}}, {@access_uid={'access', 0x3d, r2}}, {@noextend}, {@cache_fscache}, {@access_user}]}}) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) (async) 10:01:56 executing program 5: sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x10) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) (async) 10:01:56 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x2270, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r3, 0x2270, &(0x7f0000000000)) (async) 10:01:56 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x54, 0x2) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) write$selinux_attr(0xffffffffffffffff, &(0x7f0000000040)='system_u:object_r:audisp_var_run_t:s0\x00', 0x26) (async, rerun: 32) r1 = socket$pptp(0x18, 0x1, 0x2) (rerun: 32) r2 = syz_open_dev$sg(&(0x7f0000000480), 0x5, 0x100) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f00000004c0)=0x1) (async) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000000c0)=0x1) (async) setsockopt$sock_void(r1, 0x1, 0x24, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000400)=""/3, &(0x7f0000000440)=0x3) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) (async, rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) (rerun: 32) 10:01:56 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:56 executing program 5: sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x10) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:57 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="6465762fff73670000000000"], 0x87ffff2) 10:01:57 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:57 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r3, 0x2270, &(0x7f0000000000)) 10:01:57 executing program 5: sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x8, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x10) (async) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:57 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) getsockopt$SO_J1939_PROMISC(r2, 0x6b, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:57 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) write$P9_RLOPEN(r2, &(0x7f0000000080)={0x18, 0xd, 0x2, {{0x1, 0x2, 0x3}, 0xfff}}, 0x18) r4 = syz_io_uring_complete(r3) setsockopt$SO_J1939_FILTER(r2, 0x6b, 0x1, &(0x7f0000000400)=[{0x3, 0x2, {0x2, 0xff, 0x1}, {0x0, 0x0, 0x3}, 0xfd, 0xfe}, {0x2, 0x2, {0x0, 0x1, 0x3}, {0x1, 0xff, 0x1}, 0xfe, 0xfd}, {0x0, 0x3, {0x1, 0x0, 0x4}, {0x0, 0xf0, 0x3}, 0xfe, 0xff}, {0x0, 0x0, {0x2, 0x0, 0x4}, {0x0, 0x0, 0x4}, 0xfd, 0x1}, {0x1, 0x2, {0x1, 0x1}, {0x1, 0x1, 0x1}, 0x2}], 0xa0) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x54, 0x2) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) socket$inet6_mptcp(0xa, 0x1, 0x106) write$selinux_attr(0xffffffffffffffff, &(0x7f0000000040)='system_u:object_r:audisp_var_run_t:s0\x00', 0x26) r1 = socket$pptp(0x18, 0x1, 0x2) r2 = syz_open_dev$sg(&(0x7f0000000480), 0x5, 0x100) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f00000004c0)=0x1) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000000c0)=0x1) setsockopt$sock_void(r1, 0x1, 0x24, 0x0, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000400)=""/3, &(0x7f0000000440)=0x3) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) syz_open_dev$sg(&(0x7f0000000080), 0x54, 0x2) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) write$selinux_attr(0xffffffffffffffff, &(0x7f0000000040)='system_u:object_r:audisp_var_run_t:s0\x00', 0x26) (async) socket$pptp(0x18, 0x1, 0x2) (async) syz_open_dev$sg(&(0x7f0000000480), 0x5, 0x100) (async) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f00000004c0)=0x1) (async) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, 0x0) (async) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f00000000c0)=0x1) (async) setsockopt$sock_void(r1, 0x1, 0x24, 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000400)=""/3, &(0x7f0000000440)=0x3) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r3, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, 0xffffffffffffffff, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) (async) 10:01:57 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) getsockopt$SO_J1939_PROMISC(r2, 0x6b, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) syz_open_dev$sg(&(0x7f0000000040), 0x80000000, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) getsockopt$SO_J1939_PROMISC(r2, 0x6b, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) (async) 10:01:57 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:57 executing program 3: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0xffffffffffffffff, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) write$P9_RLOPEN(r2, &(0x7f0000000080)={0x18, 0xd, 0x2, {{0x1, 0x2, 0x3}, 0xfff}}, 0x18) r4 = syz_io_uring_complete(r3) setsockopt$SO_J1939_FILTER(r2, 0x6b, 0x1, &(0x7f0000000400)=[{0x3, 0x2, {0x2, 0xff, 0x1}, {0x0, 0x0, 0x3}, 0xfd, 0xfe}, {0x2, 0x2, {0x0, 0x1, 0x3}, {0x1, 0xff, 0x1}, 0xfe, 0xfd}, {0x0, 0x3, {0x1, 0x0, 0x4}, {0x0, 0xf0, 0x3}, 0xfe, 0xff}, {0x0, 0x0, {0x2, 0x0, 0x4}, {0x0, 0x0, 0x4}, 0xfd, 0x1}, {0x1, 0x2, {0x1, 0x1}, {0x1, 0x1, 0x1}, 0x2}], 0xa0) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f00000000c0)) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) write$P9_RLOPEN(r2, &(0x7f0000000080)={0x18, 0xd, 0x2, {{0x1, 0x2, 0x3}, 0xfff}}, 0x18) (async) syz_io_uring_complete(r3) (async) setsockopt$SO_J1939_FILTER(r2, 0x6b, 0x1, &(0x7f0000000400)=[{0x3, 0x2, {0x2, 0xff, 0x1}, {0x0, 0x0, 0x3}, 0xfd, 0xfe}, {0x2, 0x2, {0x0, 0x1, 0x3}, {0x1, 0xff, 0x1}, 0xfe, 0xfd}, {0x0, 0x3, {0x1, 0x0, 0x4}, {0x0, 0xf0, 0x3}, 0xfe, 0xff}, {0x0, 0x0, {0x2, 0x0, 0x4}, {0x0, 0x0, 0x4}, 0xfd, 0x1}, {0x1, 0x2, {0x1, 0x1}, {0x1, 0x1, 0x1}, 0x2}], 0xa0) (async) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f00000000c0)) (async) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) socket$pptp(0x18, 0x1, 0x2) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x4c68c0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x200) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)) 10:01:57 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) getsockopt$SO_J1939_PROMISC(r2, 0x6b, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) socket$pptp(0x18, 0x1, 0x2) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) socket$pptp(0x18, 0x1, 0x2) (async) 10:01:57 executing program 3: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (rerun: 32) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async, rerun: 64) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async, rerun: 64) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) write$P9_RLOPEN(r2, &(0x7f0000000080)={0x18, 0xd, 0x2, {{0x1, 0x2, 0x3}, 0xfff}}, 0x18) (async) r4 = syz_io_uring_complete(r3) setsockopt$SO_J1939_FILTER(r2, 0x6b, 0x1, &(0x7f0000000400)=[{0x3, 0x2, {0x2, 0xff, 0x1}, {0x0, 0x0, 0x3}, 0xfd, 0xfe}, {0x2, 0x2, {0x0, 0x1, 0x3}, {0x1, 0xff, 0x1}, 0xfe, 0xfd}, {0x0, 0x3, {0x1, 0x0, 0x4}, {0x0, 0xf0, 0x3}, 0xfe, 0xff}, {0x0, 0x0, {0x2, 0x0, 0x4}, {0x0, 0x0, 0x4}, 0xfd, 0x1}, {0x1, 0x2, {0x1, 0x1}, {0x1, 0x1, 0x1}, 0x2}], 0xa0) (async) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f00000000c0)) (async, rerun: 32) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x4c68c0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x200) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)) 10:01:57 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000080)={0x9d, 0x80000000, 0xff, "3d2c98efaf70f1f13d952af914480bf77b30e6352952ec59fafe922af56fe93db24cbc000a11406a048d8f1924466b9b2669ed3b6b0ff0c68f7d05e53a30875617d758aa2bc9f8d4fac2b5df0db77f1e168b6d36edd560308063d582f020e23ab410a831e972b59585bb06b519a9c53b510e4b7434b5ae17ee89ccbfa8f999661fe81aab27af4c081525254ee3a0bef71b83dedc54ee2b8c8f2a93f2c3"}) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:57 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) socket$pptp(0x18, 0x1, 0x2) 10:01:57 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000080)={0x9d, 0x80000000, 0xff, "3d2c98efaf70f1f13d952af914480bf77b30e6352952ec59fafe922af56fe93db24cbc000a11406a048d8f1924466b9b2669ed3b6b0ff0c68f7d05e53a30875617d758aa2bc9f8d4fac2b5df0db77f1e168b6d36edd560308063d582f020e23ab410a831e972b59585bb06b519a9c53b510e4b7434b5ae17ee89ccbfa8f999661fe81aab27af4c081525254ee3a0bef71b83dedc54ee2b8c8f2a93f2c3"}) (async, rerun: 64) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (rerun: 64) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0xc00) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x7, 0x100) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x3, 0x4c68c0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f0000000080), 0x7, 0x200) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f00000000c0)) 10:01:57 executing program 3: openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) 10:01:57 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x200001, 0x0) setsockopt$llc_int(r1, 0x10c, 0x9, &(0x7f00000000c0)=0x5, 0x4) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x10000) r1 = syz_open_dev$sg(&(0x7f0000000180), 0x80000000, 0x501081) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000001c0)=0x1) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000140)=0xfffff000) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0xc00) (async) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x7, 0x100) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:57 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f0000000080)) 10:01:57 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000080)={0x9d, 0x80000000, 0xff, "3d2c98efaf70f1f13d952af914480bf77b30e6352952ec59fafe922af56fe93db24cbc000a11406a048d8f1924466b9b2669ed3b6b0ff0c68f7d05e53a30875617d758aa2bc9f8d4fac2b5df0db77f1e168b6d36edd560308063d582f020e23ab410a831e972b59585bb06b519a9c53b510e4b7434b5ae17ee89ccbfa8f999661fe81aab27af4c081525254ee3a0bef71b83dedc54ee2b8c8f2a93f2c3"}) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x10000) r1 = syz_open_dev$sg(&(0x7f0000000180), 0x80000000, 0x501081) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000001c0)=0x1) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000140)=0xfffff000) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x10000) (async) syz_open_dev$sg(&(0x7f0000000180), 0x80000000, 0x501081) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000001c0)=0x1) (async) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) (async) openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) (async) openat$urandom(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000140)=0xfffff000) (async) [ 3394.557349][T32052] ================================================================== [ 3394.557378][T32052] BUG: KCSAN: data-race in __percpu_counter_compare / percpu_counter_add_batch [ 3394.557403][T32052] [ 3394.557409][T32052] read-write to 0xffff88810004b490 of 8 bytes by task 32051 on cpu 1: [ 3394.557427][T32052] percpu_counter_add_batch+0x9a/0x110 [ 3394.557447][T32052] shmem_getpage_gfp+0x4b3/0x1750 [ 3394.557466][T32052] shmem_write_begin+0x84/0x110 [ 3394.557484][T32052] generic_perform_write+0x1d4/0x3f0 [ 3394.557507][T32052] __generic_file_write_iter+0xe3/0x280 [ 3394.557529][T32052] generic_file_write_iter+0x75/0x130 [ 3394.557552][T32052] vfs_write+0x71c/0x890 [ 3394.557570][T32052] ksys_write+0xe8/0x1a0 [ 3394.557588][T32052] __x64_sys_write+0x3e/0x50 [ 3394.557605][T32052] do_syscall_64+0x2b/0x70 10:01:57 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182", @ANYRESOCT], 0x16) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0xc00) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x7, 0x100) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x7, 0xc00) (async) syz_open_dev$sg(&(0x7f00000000c0), 0x7, 0x100) (async) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:57 executing program 4: ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000300)={0x0, 0xfffffffffffffffe, 0x71, 0x8, @buffer={0x0, 0xc7, &(0x7f0000000080)=""/199}, &(0x7f0000000180)="1659cc259771b5ad0d7abb5b0e3ca58bff30ae7500f7379a1774389c507a967f5db28256ac9c60f63f8adf19b4f09f35578aa56eb9f6231ae33097c8de8d5a09707eda00495757d686c24ce0b9d250377a71ef4ee8d41f1b3a909a204ac13514d487c06d78c5f8783391669dbb3c3119ac", &(0x7f0000000200)=""/157, 0x5, 0x15, 0x2, &(0x7f00000002c0)}) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000380)=0x1) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) 10:01:57 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r0) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f0000000080)) (async) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x10000) r1 = syz_open_dev$sg(&(0x7f0000000180), 0x80000000, 0x501081) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000001c0)=0x1) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000140)=0xfffff000) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x10000) (async) syz_open_dev$sg(&(0x7f0000000180), 0x80000000, 0x501081) (async) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000001c0)=0x1) (async) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) (async) openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) (async) openat$urandom(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000140)=0xfffff000) (async) 10:01:57 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x200001, 0x0) setsockopt$llc_int(r1, 0x10c, 0x9, &(0x7f00000000c0)=0x5, 0x4) [ 3394.557625][T32052] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 3394.557647][T32052] [ 3394.557651][T32052] read to 0xffff88810004b490 of 8 bytes by task 32052 on cpu 0: [ 3394.557668][T32052] __percpu_counter_compare+0x27/0x1a0 10:01:57 executing program 4: ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000300)={0x0, 0xfffffffffffffffe, 0x71, 0x8, @buffer={0x0, 0xc7, &(0x7f0000000080)=""/199}, &(0x7f0000000180)="1659cc259771b5ad0d7abb5b0e3ca58bff30ae7500f7379a1774389c507a967f5db28256ac9c60f63f8adf19b4f09f35578aa56eb9f6231ae33097c8de8d5a09707eda00495757d686c24ce0b9d250377a71ef4ee8d41f1b3a909a204ac13514d487c06d78c5f8783391669dbb3c3119ac", &(0x7f0000000200)=""/157, 0x5, 0x15, 0x2, &(0x7f00000002c0)}) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000380)=0x1) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000300)={0x0, 0xfffffffffffffffe, 0x71, 0x8, @buffer={0x0, 0xc7, &(0x7f0000000080)=""/199}, &(0x7f0000000180)="1659cc259771b5ad0d7abb5b0e3ca58bff30ae7500f7379a1774389c507a967f5db28256ac9c60f63f8adf19b4f09f35578aa56eb9f6231ae33097c8de8d5a09707eda00495757d686c24ce0b9d250377a71ef4ee8d41f1b3a909a204ac13514d487c06d78c5f8783391669dbb3c3119ac", &(0x7f0000000200)=""/157, 0x5, 0x15, 0x2, &(0x7f00000002c0)}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000380)=0x1) (async) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) (async) 10:01:57 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, 0x0, 0x0, 0x4) r1 = syz_io_uring_complete(r0) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r1, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2201, &(0x7f0000000080)) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x2f, 0x3, 0x5, 0x1, 0x6, @remote, @private0={0xfc, 0x0, '\x00', 0x1}, 0x20, 0x10, 0x6, 0x8}}) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x6a24, &(0x7f0000000100)={0x0, 0xf2f, 0x2, 0x0, 0x110, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) r4 = syz_open_dev$sg(&(0x7f0000000080), 0x9, 0xb0002) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, 0x0, 0x0, 0x4) r6 = syz_io_uring_complete(r5) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x2, 0x10c}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000500), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r6, 0x0) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440), 0x840, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@uname={'uname', 0x3d, 'veth0_to_team\x00'}}, {@dfltgid={'dfltgid', 0x3d, 0xee01}}, {@access_client}]}}) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f00000000c0)=0x1f) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) [ 3394.557687][T32052] shmem_getpage_gfp+0x47c/0x1750 [ 3394.557710][T32052] shmem_write_begin+0x84/0x110 [ 3394.557729][T32052] generic_perform_write+0x1d4/0x3f0 [ 3394.557751][T32052] __generic_file_write_iter+0xe3/0x280 [ 3394.557773][T32052] generic_file_write_iter+0x75/0x130 [ 3394.557795][T32052] vfs_write+0x71c/0x890 [ 3394.557813][T32052] ksys_write+0xe8/0x1a0 [ 3394.557831][T32052] __x64_sys_write+0x3e/0x50 [ 3394.557850][T32052] do_syscall_64+0x2b/0x70 [ 3394.557870][T32052] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 3394.557891][T32052] [ 3394.557894][T32052] value changed: 0x0000000000001368 -> 0x0000000000001388 [ 3394.557905][T32052] [ 3394.557908][T32052] Reported by Kernel Concurrency Sanitizer on: [ 3394.557915][T32052] CPU: 0 PID: 32052 Comm: syz-executor.2 Not tainted 5.18.0-syzkaller-12108-g58f9d52ff689-dirty #0 [ 3394.557939][T32052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3394.557951][T32052] ================================================================== 10:01:57 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, 0x0, 0x16) 10:01:57 executing program 4: ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000300)={0x0, 0xfffffffffffffffe, 0x71, 0x8, @buffer={0x0, 0xc7, &(0x7f0000000080)=""/199}, &(0x7f0000000180)="1659cc259771b5ad0d7abb5b0e3ca58bff30ae7500f7379a1774389c507a967f5db28256ac9c60f63f8adf19b4f09f35578aa56eb9f6231ae33097c8de8d5a09707eda00495757d686c24ce0b9d250377a71ef4ee8d41f1b3a909a204ac13514d487c06d78c5f8783391669dbb3c3119ac", &(0x7f0000000200)=""/157, 0x5, 0x15, 0x2, &(0x7f00000002c0)}) r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000380)=0x1) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000300)={0x0, 0xfffffffffffffffe, 0x71, 0x8, @buffer={0x0, 0xc7, &(0x7f0000000080)=""/199}, &(0x7f0000000180)="1659cc259771b5ad0d7abb5b0e3ca58bff30ae7500f7379a1774389c507a967f5db28256ac9c60f63f8adf19b4f09f35578aa56eb9f6231ae33097c8de8d5a09707eda00495757d686c24ce0b9d250377a71ef4ee8d41f1b3a909a204ac13514d487c06d78c5f8783391669dbb3c3119ac", &(0x7f0000000200)=""/157, 0x5, 0x15, 0x2, &(0x7f00000002c0)}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000380)=0x1) (async) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) (async) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x2f, 0x3, 0x5, 0x1, 0x6, @remote, @private0={0xfc, 0x0, '\x00', 0x1}, 0x20, 0x10, 0x6, 0x8}}) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) (async) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x6a24, &(0x7f0000000100)={0x0, 0xf2f, 0x2, 0x0, 0x110, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) (async, rerun: 64) r4 = syz_open_dev$sg(&(0x7f0000000080), 0x9, 0xb0002) (async, rerun: 64) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, 0x0, 0x0, 0x4) (async) r6 = syz_io_uring_complete(r5) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x2, 0x10c}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000500), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r6, 0x0) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440), 0x840, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@uname={'uname', 0x3d, 'veth0_to_team\x00'}}, {@dfltgid={'dfltgid', 0x3d, 0xee01}}, {@access_client}]}}) (async) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f00000000c0)=0x1f) 10:01:57 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x200001, 0x0) setsockopt$llc_int(r1, 0x10c, 0x9, &(0x7f00000000c0)=0x5, 0x4) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x200001, 0x0) (async) setsockopt$llc_int(r1, 0x10c, 0x9, &(0x7f00000000c0)=0x5, 0x4) (async) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000000, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000080)={0x50, ""/80}) 10:01:57 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x2f, 0x3, 0x5, 0x1, 0x6, @remote, @private0={0xfc, 0x0, '\x00', 0x1}, 0x20, 0x10, 0x6, 0x8}}) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x2f, 0x3, 0x5, 0x1, 0x6, @remote, @private0={0xfc, 0x0, '\x00', 0x1}, 0x20, 0x10, 0x6, 0x8}}) (async) 10:01:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) r3 = syz_io_uring_setup(0x6a24, &(0x7f0000000100)={0x0, 0xf2f, 0x2, 0x0, 0x110, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000100)) r4 = syz_open_dev$sg(&(0x7f0000000080), 0x9, 0xb0002) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r5, 0x118, 0x0, 0x0, 0x4) (async) r6 = syz_io_uring_complete(r5) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x2, 0x10c}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000500), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r6, 0x0) (async) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440), 0x840, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@uname={'uname', 0x3d, 'veth0_to_team\x00'}}, {@dfltgid={'dfltgid', 0x3d, 0xee01}}, {@access_client}]}}) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f00000000c0)=0x1f) 10:01:57 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20940, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 10:01:57 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000000, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000080)={0x50, ""/80}) 10:01:57 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20940, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) 10:01:58 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, 0x0, 0x16) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) socket$pppl2tp(0x18, 0x1, 0x1) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000008, 0x10, 0xffffffffffffffff, 0x10000000) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x80000000000, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000080)={0x50, ""/80}) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r2}, 0x8) 10:01:58 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20940, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x20940, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) (async) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f6221f8313273660000000000"], 0x87ffff2) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x114, &(0x7f0000000000)=0x5, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000005, 0x50, r0, 0x8000000) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008727865001400330076657468315f766972745f77696669002ffc2c516d37ae2a626c185dea98"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) accept4$llc(r2, 0x0, &(0x7f0000000040), 0x80000) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r2}, 0x8) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) tkill(0x0, 0x3c) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000008, 0x10, 0xffffffffffffffff, 0x10000000) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r2}, 0x8) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r2}, 0x8) (async) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) (async) tkill(0x0, 0x3c) 10:01:58 executing program 4: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1}, 0x18) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', r1, 0x2f, 0x8, 0x40, 0x3, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, 0x1, 0x80, 0x8a77, 0xfffffffc}}) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) socketpair(0x21, 0x80000, 0x2000000, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'ip6_vti0\x00', r1, 0x4, 0x1, 0x1, 0x7ff, 0x14, @rand_addr=' \x01\x00', @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x8, 0x6bc, 0x6}}) 10:01:58 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, 0x0, 0x16) 10:01:58 executing program 4: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1}, 0x18) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', r1, 0x2f, 0x8, 0x40, 0x3, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, 0x1, 0x80, 0x8a77, 0xfffffffc}}) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) socketpair(0x21, 0x80000, 0x2000000, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'ip6_vti0\x00', r1, 0x4, 0x1, 0x1, 0x7ff, 0x14, @rand_addr=' \x01\x00', @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x8, 0x6bc, 0x6}}) socket$can_j1939(0x1d, 0x2, 0x7) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', r1, 0x2f, 0x8, 0x40, 0x3, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, 0x1, 0x80, 0x8a77, 0xfffffffc}}) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async) socketpair(0x21, 0x80000, 0x2000000, &(0x7f0000000140)) (async) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'ip6_vti0\x00', r1, 0x4, 0x1, 0x1, 0x7ff, 0x14, @rand_addr=' \x01\x00', @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x8, 0x6bc, 0x6}}) (async) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) (async) tkill(0x0, 0x3c) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000080)) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) socket$pppl2tp(0x18, 0x1, 0x1) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async, rerun: 64) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (rerun: 64) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000008, 0x10, 0xffffffffffffffff, 0x10000000) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:58 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x6020c1, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000080)) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f6221f8313273660000000000"], 0x87ffff2) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x114, &(0x7f0000000000)=0x5, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000005, 0x50, r0, 0x8000000) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008727865001400330076657468315f766972745f77696669002ffc2c516d37ae2a626c185dea98"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) accept4$llc(r2, 0x0, &(0x7f0000000040), 0x80000) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f6221f8313273660000000000"], 0x87ffff2) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x114, &(0x7f0000000000)=0x5, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000005, 0x50, r0, 0x8000000) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008727865001400330076657468315f766972745f77696669002ffc2c516d37ae2a626c185dea98"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) accept4$llc(r2, 0x0, &(0x7f0000000040), 0x80000) (async) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000080)=0x6) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:58 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x6020c1, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000080)) 10:01:58 executing program 4: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1}, 0x18) (async) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'ip6_vti0\x00', r1, 0x2f, 0x8, 0x40, 0x3, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, 0x1, 0x80, 0x8a77, 0xfffffffc}}) (async) r2 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x2270, &(0x7f0000000000)) (async) socketpair(0x21, 0x80000, 0x2000000, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'ip6_vti0\x00', r1, 0x4, 0x1, 0x1, 0x7ff, 0x14, @rand_addr=' \x01\x00', @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x8, 0x6bc, 0x6}}) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x44, 0x0, 0x400, 0x70fc28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x471}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x202}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004}, 0x8080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) socket$l2tp6(0xa, 0x2, 0x73) 10:01:58 executing program 1: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x6020c1, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000080)) 10:01:58 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0xe, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, [@generic={0x7f, 0xa, 0x1, 0x5, 0x5}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x5}, @generic={0x2, 0x9, 0x6, 0x4, 0xfffffffa}, @call={0x85, 0x0, 0x0, 0x1ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x2}, @alu={0x0, 0x0, 0x0, 0x4, 0x8, 0x1, 0x1}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8}, @jmp={0x5, 0x0, 0x7, 0xb, 0x2, 0x2c, 0xfffffffffffffffc}]}, &(0x7f0000000100)='GPL\x00', 0x1, 0x8f, &(0x7f0000000140)=""/143, 0x41000, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000200)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0x5, 0x800000, 0x4d65}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000280)=[0x1, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff]}, 0x80) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000080)=0x6) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:58 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182"], 0x16) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x44, 0x0, 0x400, 0x70fc28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x471}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x202}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004}, 0x8080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) socket$l2tp6(0xa, 0x2, 0x73) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x44, 0x0, 0x400, 0x70fc28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x471}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x202}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004}, 0x8080) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000180)={0x43, 0x8, 0x1, "e978af3b4555a4cc2f394c1aa1095fb24d0eb3e124d15daaf16e63e4d720bd4d56a612c7d6d7c0b0a87d83938a072fc33ad0002dd9009f64253b7a8c4535082e6a374a"}) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x84000, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000140)=0x6e) 10:01:58 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0xe, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, [@generic={0x7f, 0xa, 0x1, 0x5, 0x5}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x5}, @generic={0x2, 0x9, 0x6, 0x4, 0xfffffffa}, @call={0x85, 0x0, 0x0, 0x1ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x2}, @alu={0x0, 0x0, 0x0, 0x4, 0x8, 0x1, 0x1}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8}, @jmp={0x5, 0x0, 0x7, 0xb, 0x2, 0x2c, 0xfffffffffffffffc}]}, &(0x7f0000000100)='GPL\x00', 0x1, 0x8f, &(0x7f0000000140)=""/143, 0x41000, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000200)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0x5, 0x800000, 0x4d65}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000280)=[0x1, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff]}, 0x80) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000080)=0x6) (async, rerun: 32) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (rerun: 32) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000007000009002f6465762f6221f8313273660000000000"], 0x87ffff2) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x114, &(0x7f0000000000)=0x5, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000005, 0x50, r0, 0x8000000) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008727865001400330076657468315f766972745f77696669002ffc2c516d37ae2a626c185dea98"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) accept4$llc(r2, 0x0, &(0x7f0000000040), 0x80000) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000180)={0x43, 0x8, 0x1, "e978af3b4555a4cc2f394c1aa1095fb24d0eb3e124d15daaf16e63e4d720bd4d56a612c7d6d7c0b0a87d83938a072fc33ad0002dd9009f64253b7a8c4535082e6a374a"}) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x84000, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000140)=0x6e) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000180)={0x43, 0x8, 0x1, "e978af3b4555a4cc2f394c1aa1095fb24d0eb3e124d15daaf16e63e4d720bd4d56a612c7d6d7c0b0a87d83938a072fc33ad0002dd9009f64253b7a8c4535082e6a374a"}) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x84000, 0x0) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) (async) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000140)=0x6e) (async) 10:01:58 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0xe, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, [@generic={0x7f, 0xa, 0x1, 0x5, 0x5}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x5}, @generic={0x2, 0x9, 0x6, 0x4, 0xfffffffa}, @call={0x85, 0x0, 0x0, 0x1ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x2}, @alu={0x0, 0x0, 0x0, 0x4, 0x8, 0x1, 0x1}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8}, @jmp={0x5, 0x0, 0x7, 0xb, 0x2, 0x2c, 0xfffffffffffffffc}]}, &(0x7f0000000100)='GPL\x00', 0x1, 0x8f, &(0x7f0000000140)=""/143, 0x41000, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000200)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0x5, 0x800000, 0x4d65}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000280)=[0x1, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff]}, 0x80) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x2cc82) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140833006970766c616e300000000000000000000900020073797a32006523000000080041007369770014003300000000000000000000000000000000000900020073797a30000000000800410072786500140033007369743000"/296], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000080)) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x44, 0x0, 0x400, 0x70fc28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x471}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x202}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004}, 0x8080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) socket$l2tp6(0xa, 0x2, 0x73) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000180)={0x43, 0x8, 0x1, "e978af3b4555a4cc2f394c1aa1095fb24d0eb3e124d15daaf16e63e4d720bd4d56a612c7d6d7c0b0a87d83938a072fc33ad0002dd9009f64253b7a8c4535082e6a374a"}) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x84000, 0x0) (async) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000140)=0x6e) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x47ad03, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:58 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64, @ANYBLOB="5f4969669df952bb7256a1985fb79d00d28b603a74c6eabb7a782f149a60f31fc1edee7021c63ed4094f19903fc905d500c2c1b7d226afe433eb74b8bd9bafb6dfe37077ad8e7d600216435a5927ad781bfcefeb58160794ce43099c61b915c5b161bc1ab4882f044ce82b46514da68ac228f8faee0ddddd95ddb73d088c5b21f9f8cd3a634ebfe8c73d25c84e8f32df707f60ff67662ed091633bd05b556f1ef85bf5f995db9b519252cd6ed7f56bb0193346388f1e668f4e56cdb3a1bca4a90fbf8de3370673c200417ce87cd4599b1a436bc630a2de30bae847aea3c20a8369dd62a9daad1917e0857a085182"], 0x16) 10:01:58 executing program 4: r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$SO_J1939_SEND_PRIO(r3, 0x6b, 0x3, 0x0, &(0x7f0000000080)=0x4) syz_io_uring_complete(r2) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf27, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000001c0)) r5 = accept4$vsock_stream(r0, &(0x7f0000000400)={0x28, 0x0, 0x0, @local}, 0x10, 0xc0000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x6084, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB="2c64666c747569643d4e3fd789294d5de074fe7dafbd775fcc9e247610e9e919fda5e4fddc41b33f0f39e3cf1b2c01d388a5984faa4931a0eb5a5ffa454d186c6080ca79f20f8ace889daa09720b20faebd4e07e8b6e307e41d2dd5760a9930bc715aa321ed132d79ec646e05bbc44dd6c4edddab7ca39a2dd83f8e24e47c198f10e117059", @ANYRESHEX=0xee01, @ANYBLOB=',dont_measure,hash,subj_type=/dev/sg#\x00,context=root,dont_appraise,audit,euid>', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a315dacf78d20354bab26ca0000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x2cc82) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140833006970766c616e300000000000000000000900020073797a32006523000000080041007369770014003300000000000000000000000000000000000900020073797a30000000000800410072786500140033007369743000"/296], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000080)) (async) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) getrusage(0xffffffffffffffff, &(0x7f0000000400)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x1ac080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000080)) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x47ad03, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x47ad03, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x1ac080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000080)) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x2cc82) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140833006970766c616e300000000000000000000900020073797a32006523000000080041007369770014003300000000000000000000000000000000000900020073797a30000000000800410072786500140033007369743000"/296], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000080)) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x2cc82) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a310000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140833006970766c616e300000000000000000000900020073797a32006523000000080041007369770014003300000000000000000000000000000000000900020073797a30000000000800410072786500140033007369743000"/296], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000080)) (async) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) (async) getrusage(0xffffffffffffffff, &(0x7f0000000400)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x47ad03, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:58 executing program 4: r0 = socket$vsock_stream(0x28, 0x1, 0x0) (async) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) r3 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$SO_J1939_SEND_PRIO(r3, 0x6b, 0x3, 0x0, &(0x7f0000000080)=0x4) (async) syz_io_uring_complete(r2) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf27, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000001c0)) (async) r5 = accept4$vsock_stream(r0, &(0x7f0000000400)={0x28, 0x0, 0x0, @local}, 0x10, 0xc0000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x6084, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB="2c64666c747569643d4e3fd789294d5de074fe7dafbd775fcc9e247610e9e919fda5e4fddc41b33f0f39e3cf1b2c01d388a5984faa4931a0eb5a5ffa454d186c6080ca79f20f8ace889daa09720b20faebd4e07e8b6e307e41d2dd5760a9930bc715aa321ed132d79ec646e05bbc44dd6c4edddab7ca39a2dd83f8e24e47c198f10e117059", @ANYRESHEX=0xee01, @ANYBLOB=',dont_measure,hash,subj_type=/dev/sg#\x00,context=root,dont_appraise,audit,euid>', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a315dacf78d20354bab26ca0000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) 10:01:58 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x1ac080) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000080)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x1ac080) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000080)) (async) 10:01:58 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC, @ANYRES64], 0x16) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x4f4c03, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) getrusage(0xffffffffffffffff, &(0x7f0000000400)) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f00000004c0)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) (async) getrusage(0xffffffffffffffff, &(0x7f0000000400)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) (async) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000200, 0x488701) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:58 executing program 4: r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$SO_J1939_SEND_PRIO(r3, 0x6b, 0x3, 0x0, &(0x7f0000000080)=0x4) syz_io_uring_complete(r2) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r4 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf27, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000001c0)) r5 = accept4$vsock_stream(r0, &(0x7f0000000400)={0x28, 0x0, 0x0, @local}, 0x10, 0xc0000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x6084, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB="2c64666c747569643d4e3fd789294d5de074fe7dafbd775fcc9e247610e9e919fda5e4fddc41b33f0f39e3cf1b2c01d388a5984faa4931a0eb5a5ffa454d186c6080ca79f20f8ace889daa09720b20faebd4e07e8b6e307e41d2dd5760a9930bc715aa321ed132d79ec646e05bbc44dd6c4edddab7ca39a2dd83f8e24e47c198f10e117059", @ANYRESHEX=0xee01, @ANYBLOB=',dont_measure,hash,subj_type=/dev/sg#\x00,context=root,dont_appraise,audit,euid>', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a315dacf78d20354bab26ca0000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) socket$vsock_stream(0x28, 0x1, 0x0) (async) syz_open_dev$sg(&(0x7f0000000040), 0x7fff, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2270, &(0x7f0000000000)) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) getsockopt$SO_J1939_SEND_PRIO(r3, 0x6b, 0x3, 0x0, &(0x7f0000000080)=0x4) (async) syz_io_uring_complete(r2) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf27, 0x1, 0x0, 0x10c, 0x0, r4}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000080), &(0x7f00000001c0)) (async) accept4$vsock_stream(r0, &(0x7f0000000400)={0x28, 0x0, 0x0, @local}, 0x10, 0xc0000) (async) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x6084, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB="2c64666c747569643d4e3fd789294d5de074fe7dafbd775fcc9e247610e9e919fda5e4fddc41b33f0f39e3cf1b2c01d388a5984faa4931a0eb5a5ffa454d186c6080ca79f20f8ace889daa09720b20faebd4e07e8b6e307e41d2dd5760a9930bc715aa321ed132d79ec646e05bbc44dd6c4edddab7ca39a2dd83f8e24e47c198f10e117059", @ANYRESHEX=0xee01, @ANYBLOB=',dont_measure,hash,subj_type=/dev/sg#\x00,context=root,dont_appraise,audit,euid>', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="28010000031404062cbd7000fedbdf250900020073797a315dacf78d20354bab26ca0000000008004100736977001400330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a32000000000800410073697700140033006e6574706369300000000000000000000900020073797a30000000000800410072786500140033006d6163766c616e3000000000000000000900020073797a31000000000800410072786500140033006970766c616e300000000000000000000900020073797a3200000000080041007369770014003300000000000000000000000000000000000900020073797a300000000008004100727865001400330076657468315f"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r4, 0x0) (async) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) (async) 10:01:58 executing program 0: r0 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r0, 0x8000000) r1 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r1, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000007, 0xfffff, r1, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) bind$can_j1939(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r3, 0x3, {0x1, 0x0, 0x4}, 0x1}, 0x18) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000380)={&(0x7f0000000040)={0x2, 0x4e23, @private}, 0x10, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="100000000000000000000000e1997d2f"], 0x10}, 0x10) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x7, 0x2, {0x1, '\''}}, 0xa) ioctl$SG_GET_NUM_WAITING(r5, 0x2203, &(0x7f0000000000)) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x2800) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:58 executing program 0: r0 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r0, 0x8000000) (async) r1 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r1, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000007, 0xfffff, r1, 0x0) (async) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) (async) bind$can_j1939(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r3, 0x3, {0x1, 0x0, 0x4}, 0x1}, 0x18) (async) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000380)={&(0x7f0000000040)={0x2, 0x4e23, @private}, 0x10, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="100000000000000000000000e1997d2f"], 0x10}, 0x10) (async) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x7, 0x2, {0x1, '\''}}, 0xa) (async) ioctl$SG_GET_NUM_WAITING(r5, 0x2203, &(0x7f0000000000)) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000200, 0x488701) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x10000200, 0x488701) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x4f4c03, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:58 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000080)) 10:01:58 executing program 0: r0 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r0, 0x8000000) r1 = syz_io_uring_setup(0x1435, &(0x7f0000000100), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x82010, r1, 0x8000000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000007, 0xfffff, r1, 0x0) (async) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r3}, 0x18) (async) bind$can_j1939(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r3, 0x3, {0x1, 0x0, 0x4}, 0x1}, 0x18) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000380)={&(0x7f0000000040)={0x2, 0x4e23, @private}, 0x10, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="100000000000000000000000e1997d2f"], 0x10}, 0x10) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x7, 0x2, {0x1, '\''}}, 0xa) ioctl$SG_GET_NUM_WAITING(r5, 0x2203, &(0x7f0000000000)) [ 3395.794798][ T25] audit: type=1400 audit(1654250518.786:298): avc: denied { execute } for pid=32388 comm="syz-executor.0" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=1803991 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 10:01:58 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2", @ANYRESDEC], 0x16) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x2800) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x4f4c03, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x10000200, 0x488701) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:58 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (rerun: 32) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000080)) 10:01:58 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) ioctl$SG_GET_NUM_WAITING(r1, 0x2203, &(0x7f0000000000)) 10:01:58 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) socket$pppoe(0x18, 0x1, 0x0) 10:01:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x9, 0x2800) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) 10:01:58 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4000000, 0x88c2) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:58 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) ioctl$SG_GET_NUM_WAITING(r1, 0x2203, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) (async) bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) (async) ioctl$SG_GET_NUM_WAITING(r1, 0x2203, &(0x7f0000000000)) (async) 10:01:58 executing program 4: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000080)) 10:01:59 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4000000, 0x88c2) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:59 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2"], 0x16) 10:01:59 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x80100) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000080)) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x1, 0x4) 10:01:59 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) r1 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r0}, 0x8) ioctl$SG_GET_NUM_WAITING(r1, 0x2203, &(0x7f0000000000)) 10:01:59 executing program 1: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000400)={0x1d, r1, 0x1, {0x1, 0x0, 0x2}, 0xff}, 0x18) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x13, 0x3ff, 0x0, 0xfffffff9, 0x0, 0x1, 0x8, '\x00', r1, r3, 0x1, 0x4, 0x6}, 0x48) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x2201, &(0x7f0000000000)) r5 = openat$random(0xffffffffffffff9c, &(0x7f0000000440), 0x602, 0x0) ioctl$RNDADDENTROPY(r5, 0x40085203, &(0x7f0000000480)={0x6, 0xb9, "63a8cf655aa85d01ea0a2f02d23a99ec37965fb61839f0c4f249d05ca71d810713df75690d4520207dff8f8eab7b6d8003433341a6a97cf640923653d2736db6a191260dcfb5e0644316d32f3fd403a831106d8e4309b882b8e73b8bb2669711fe0ad4c8453da40a8dc045cd448ef2f3af934eb7beee1964f067bd822bb06b7df48423765b801467dd4346ee0369cd34d1d7e9e45d0fe5dd915111aa5e86b4312c9893ea2f94485e7fb88dd7e7cdb681a4a66b69f00282c25e"}) 10:01:59 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x4000000, 0x88c2) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x4000000, 0x88c2) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:59 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) socket$pppoe(0x18, 0x1, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) socket$pppoe(0x18, 0x1, 0x0) (async) 10:01:59 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x80100) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000080)) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x1, 0x4) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x80100) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000080)) (async) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x1, 0x4) (async) 10:01:59 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x800) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:59 executing program 1: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000400)={0x1d, r1, 0x1, {0x1, 0x0, 0x2}, 0xff}, 0x18) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x13, 0x3ff, 0x0, 0xfffffff9, 0x0, 0x1, 0x8, '\x00', r1, r3, 0x1, 0x4, 0x6}, 0x48) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x2201, &(0x7f0000000000)) r5 = openat$random(0xffffffffffffff9c, &(0x7f0000000440), 0x602, 0x0) ioctl$RNDADDENTROPY(r5, 0x40085203, &(0x7f0000000480)={0x6, 0xb9, "63a8cf655aa85d01ea0a2f02d23a99ec37965fb61839f0c4f249d05ca71d810713df75690d4520207dff8f8eab7b6d8003433341a6a97cf640923653d2736db6a191260dcfb5e0644316d32f3fd403a831106d8e4309b882b8e73b8bb2669711fe0ad4c8453da40a8dc045cd448ef2f3af934eb7beee1964f067bd822bb06b7df48423765b801467dd4346ee0369cd34d1d7e9e45d0fe5dd915111aa5e86b4312c9893ea2f94485e7fb88dd7e7cdb681a4a66b69f00282c25e"}) socket$can_j1939(0x1d, 0x2, 0x7) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1}, 0x18) (async) connect$can_j1939(r0, &(0x7f0000000400)={0x1d, r1, 0x1, {0x1, 0x0, 0x2}, 0xff}, 0x18) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r2) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x13, 0x3ff, 0x0, 0xfffffff9, 0x0, 0x1, 0x8, '\x00', r1, r3, 0x1, 0x4, 0x6}, 0x48) (async) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r4, 0x2201, &(0x7f0000000000)) (async) openat$random(0xffffffffffffff9c, &(0x7f0000000440), 0x602, 0x0) (async) ioctl$RNDADDENTROPY(r5, 0x40085203, &(0x7f0000000480)={0x6, 0xb9, "63a8cf655aa85d01ea0a2f02d23a99ec37965fb61839f0c4f249d05ca71d810713df75690d4520207dff8f8eab7b6d8003433341a6a97cf640923653d2736db6a191260dcfb5e0644316d32f3fd403a831106d8e4309b882b8e73b8bb2669711fe0ad4c8453da40a8dc045cd448ef2f3af934eb7beee1964f067bd822bb06b7df48423765b801467dd4346ee0369cd34d1d7e9e45d0fe5dd915111aa5e86b4312c9893ea2f94485e7fb88dd7e7cdb681a4a66b69f00282c25e"}) (async) 10:01:59 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="d2981dcc8c28010000031404062cbd7000fedbdf250900020073797a310006000008004100736977005e00330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a3200000000f04aa33f73697700140033006e657470636930000000000000000036e339529ffe0ea1dcf4294c000900020073797a30000000000800410072786500140033006d6163766c616e300000006b73b0ada7b0f7af0073797a310000000008004100e772786500140033006970766c616e300000000000000000000900020073797a320000000008004100736977001400330067656e657665310000000000000000000900020073797a300000000008004100c650cb1214003300766574"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:59 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x80100) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000080)) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x1, 0x4) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x80100) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) ioctl$SG_SET_FORCE_PACK_ID(0xffffffffffffffff, 0x227b, &(0x7f0000000080)) (async) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x1, 0x4) (async) 10:01:59 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="d2981dcc8c28010000031404062cbd7000fedbdf250900020073797a310006000008004100736977005e00330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a3200000000f04aa33f73697700140033006e657470636930000000000000000036e339529ffe0ea1dcf4294c000900020073797a30000000000800410072786500140033006d6163766c616e300000006b73b0ada7b0f7af0073797a310000000008004100e772786500140033006970766c616e300000000000000000000900020073797a320000000008004100736977001400330067656e657665310000000000000000000900020073797a300000000008004100c650cb1214003300766574"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) 10:01:59 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16=r0, @ANYBLOB="eb1a136304731fb53c44d1294f7fc9da3f5cb14548d1c36ca9d16878814c839cc1a137052a9eed31b507070dc186a5baa192495c6c0ad33f2eed0102f54272832ed6d2"], 0x16) 10:01:59 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x800) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) 10:01:59 executing program 1: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r1}, 0x18) (async) connect$can_j1939(r0, &(0x7f0000000400)={0x1d, r1, 0x1, {0x1, 0x0, 0x2}, 0xff}, 0x18) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x13, 0x3ff, 0x0, 0xfffffff9, 0x0, 0x1, 0x8, '\x00', r1, r3, 0x1, 0x4, 0x6}, 0x48) (async) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x2201, &(0x7f0000000000)) (async) r5 = openat$random(0xffffffffffffff9c, &(0x7f0000000440), 0x602, 0x0) ioctl$RNDADDENTROPY(r5, 0x40085203, &(0x7f0000000480)={0x6, 0xb9, "63a8cf655aa85d01ea0a2f02d23a99ec37965fb61839f0c4f249d05ca71d810713df75690d4520207dff8f8eab7b6d8003433341a6a97cf640923653d2736db6a191260dcfb5e0644316d32f3fd403a831106d8e4309b882b8e73b8bb2669711fe0ad4c8453da40a8dc045cd448ef2f3af934eb7beee1964f067bd822bb06b7df48423765b801467dd4346ee0369cd34d1d7e9e45d0fe5dd915111aa5e86b4312c9893ea2f94485e7fb88dd7e7cdb681a4a66b69f00282c25e"}) 10:01:59 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffe, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) 10:01:59 executing program 3: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) socket$pppoe(0x18, 0x1, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) (async) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) (async) socket$pppoe(0x18, 0x1, 0x0) (async) 10:01:59 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) r2 = syz_io_uring_complete(r1) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="d2981dcc8c28010000031404062cbd7000fedbdf250900020073797a310006000008004100736977005e00330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a3200000000f04aa33f73697700140033006e657470636930000000000000000036e339529ffe0ea1dcf4294c000900020073797a30000000000800410072786500140033006d6163766c616e300000006b73b0ada7b0f7af0073797a310000000008004100e772786500140033006970766c616e300000000000000000000900020073797a320000000008004100736977001400330067656e657665310000000000000000000900020073797a300000000008004100c650cb1214003300766574"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r1, 0x118, 0x0, 0x0, 0x4) (async) syz_io_uring_complete(r1) (async) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r2}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="d2981dcc8c28010000031404062cbd7000fedbdf250900020073797a310006000008004100736977005e00330076657468315f746f5f627269646765000900020073797a310000000008004100727865001400330076657468305f746f5f7465616d0000000900020073797a3200000000f04aa33f73697700140033006e657470636930000000000000000036e339529ffe0ea1dcf4294c000900020073797a30000000000800410072786500140033006d6163766c616e300000006b73b0ada7b0f7af0073797a310000000008004100e772786500140033006970766c616e300000000000000000000900020073797a320000000008004100736977001400330067656e657665310000000000000000000900020073797a300000000008004100c650cb1214003300766574"], 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r2, 0x0) (async) ioctl$SG_GET_SG_TABLESIZE(r2, 0x227f, &(0x7f0000000080)) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000000)) (async) 10:01:59 executing program 0: syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x800) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$sg(&(0x7f0000000080), 0x1, 0x800) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000000)) (async) 10:01:59 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffe, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffe, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) 10:01:59 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x400, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f00000017c0)={0x53, 0xfffffffffffffffb, 0x82, 0x4, @scatter={0x7, 0x0, &(0x7f0000001600)=[{&(0x7f0000000100)=""/179, 0xb3}, {&(0x7f00000001c0)=""/196, 0xc4}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/183, 0xb7}, {&(0x7f0000001380)=""/254, 0xfe}, {&(0x7f0000001480)=""/152, 0x98}, {&(0x7f0000001540)=""/141, 0x8d}]}, &(0x7f0000001680)="e99e90ab14e0b2c5fe90eba17a4996cc048e324d5cf68f231e5d20abab8b22bfb290240b7599194acbb05c7661e77ee217d275531173a0ee07cb946e1977c1a56e0b6f8458b7a715fa3ea5c71821008c63c02fdfa2de75ab6b30e985741389d6e5e8655469af5879a9cc3ae51d58dcc70bbe33094d900d9f4376df9e8c78353053f5", &(0x7f0000001740)=""/21, 0xf6, 0x2, 0x0, &(0x7f0000001780)}) 10:01:59 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffe, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) syz_open_dev$sg(&(0x7f0000000040), 0xfffffffffffffffe, 0x0) (async) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000000)) (async) 10:01:59 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000000)) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000080)=0x1) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x400, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) (async) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_memcpy_off$IO_URING_METADATA_FLAGS(r2, 0x118, 0x0, 0x0, 0x4) (async) r3 = syz_io_uring_complete(r2) syz_io_uring_setup(0x1435, &(0x7f0000000100)={0x0, 0xf2f, 0x1, 0x0, 0x10c, 0x0, r3}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f00000003c0)={&(0x7f0000000200), 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x128, 0x1403, 0x604, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netpci0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_virt_wifi\x00'}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000003, 0x10, r3, 0x0) (async, rerun: 64) ioctl$SG_IO(r3, 0x2285, &(0x7f00000017c0)={0x53, 0xfffffffffffffffb, 0x82, 0x4, @scatter={0x7, 0x0, &(0x7f0000001600)=[{&(0x7f0000000100)=""/179, 0xb3}, {&(0x7f00000001c0)=""/196, 0xc4}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/183, 0xb7}, {&(0x7f0000001380)=""/254, 0xfe}, {&(0x7f0000001480)=""/152, 0x98}, {&(0x7f0000001540)=""/141, 0x8d}]}, &(0x7f0000001680)="e99e90ab14e0b2c5fe90eba17a4996cc048e324d5cf68f231e5d20abab8b22bfb290240b7599194acbb05c7661e77ee217d275531173a0ee07cb946e1977c1a56e0b6f8458b7a715fa3ea5c71821008c63c02fdfa2de75ab6b30e985741389d6e5e8655469af5879a9cc3ae51d58dcc70bbe33094d900d9f4376df9e8c78353053f5", &(0x7f0000001740)=""/21, 0xf6, 0x2, 0x0, &(0x7f0000001780)}) (rerun: 64) 10:01:59 executing program 5: r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan0\x00'}) r1 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x1267, &(0x7f0000000000)) msgget(0x1, 0x600) 10:01:59 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0x430001, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000000)={0x16, 0x7, 0x0, {{0x9, '/dev/bsg\x00'}}}, 0x87ffff2) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1600150007000009002f6465762f627367000101000059e77e1d49622a70b95336d3185b4a457c99", @ANYRES64, @ANYRES16